Hello, welcome to the Wednesday, September 25th, 2019 edition of the Sansonet Storms, Stormcast. My name is Johannes Ulrich, and today I'm recording from London, England.

Xavier today took another look at Certificant Transparency Logs. Certificant transparency logs are a pretty good idea. Essentially, what's

happening is that whenever you get a certificate from a public certificate authority, this certificate

is published as part of that certificate authorities. Transparency logs. The idea here is that you'll be able to detect if

someone will obtain an unauthorized certificate for one of your domains. But of course

the flip side of the certificate transparency logs is that any host name that you

disclose in your certificates may also be made public and

this of course may be a problem if this host name is only supposed to be for internal use.

Now Xavier took a look at certificates being issued for the Remote Web Access.com domain.

This domain is owned by Microsoft and Microsoft customers who are using a version of Windows

that does support Remote Web Access may obtain free host names within the remote web access.com domain

in order to remotely administer their Windows systems via a web browser.

When setting up access with Microsoft, the user is able to specify their own host name within the domain, and then also a TLS certificate

is generated for this host name, and of course, with that, the host name is published in certificate

transparency logs. Of course, you're never supposed to rely on security through obscurity,

but on the other hand, it doesn't help if people

will be able to easily find this host name that you set up to remotely access

your Windows system probably best thing you can do is use a host name that

doesn't directly relate to your organization.

And of course, if you're setting up a service like this that really only you're going to use or a couple of trusted administrators, it may be preferable to actually use an internally generated

certificate using your own internal certificate authority which doesn't publish its certificate

transparency logs.

...