Skip to main content
banner image
venafi logo

Wildcard Certificates Make Encryption Easier, But Less Secure.

Wildcard Certificates Make Encryption Easier, But Less Secure.

wildcard certificates
March 9, 2017 | David Bisson

On the surface, wildcard certificates appear to be a great way to quickly and easily deploy HTTPS across subdomains. You buy one certificate and you’re good to go for unlimited subdomains. Indeed, wildcard certificates are cheaper and easier to extend. But they are not necessarily easier to manage. If you ever need to replace your domain wildcard with a more secure EV certificate, you could face a mess of subdomains to find and fix. But the most pressing reason to avoid wildcards is that they are simply less secure and can open the door to phishing attacks. 
 

Are your wildcard certificates at risk? Uncover gaps in your protection with our free Dummies Guide. 
 

To fully comprehend why they are less secure, you must first understand a bit about the nature of wildcard certificates. A wildcard certificate is a public key certificate used by all subdomains within a larger domain. Using a wildcard certificate on a publicly facing webserver, you can quickly secure unlimited subdomains that are all encrypted by the same certificate. Unfortunately, so can cybercriminals.

If cyber criminals infiltrate your domain, they can gain privileges that allow them to create unlimited domains—all encrypted by your wildcard certificate. Even worse, these subdomains will appear to be valid because they are authenticated by your wildcard certificate. These illegitimate subdomains allow cyber criminals to host malicious websites that they can then use in phishing campaigns.

How does this work? Any subdomain created for the domain on a webserver that uses a wildcard certificate will use the same certificate. For example, a webserver with a wildcard certificate is hosting the domain https://example.com. Anyone with access to the webserver can set up a subdomain, https://phishing.example.com, on the webserver using the wildcard certificate.

Visitors to the phishing site are not likely to realize that they are on the phishing site because their browsers establish an HTTPS connection using the legitimate wildcard certificate. All these visitors often see is the green highlighted part of the URL which signals a valid site. Most visitors are not likely to scroll through the entire URL to discover the part of the URL which would arouse suspicion about its validity.

The bottom line is that no one wants their organization’s name associated with a phishing attack. It tarnishes your reputation as well as the reliability of your brand. So, you need to make it as hard as possible for cyber criminals to infiltrate your domains and manipulate your encryption. Yes, there is increased burden issuing and maintaining server or application specific certificates but with the right certificate management platform you can both reduce risk and increase awareness through automation and intelligence.

So, it just makes sense to avoid using wildcard certificates on production systems. Instead, you should use subdomain-specific certificates that are rotated often. A compromised wildcard certificate can lead to serious repercussions. But you can avoid (or at least significantly mitigate) the potential impact of an attack by using short-lived, non-wildcard certificates.

Do you use any wildcard certificates on your domains? 


Learn more about machine identity protection. Explore now.

 

Related blogs

Subscribe to our Weekly Blog Updates!

Join thousands of other security professionals

Get top blogs delivered to your inbox every week

See Popular Tags

You might also like

CIO Study: Certificate-Related Outages Continue to Plague Organizations
White Paper

CIO Study: Certificate-Related Outages Continue to Plague Organizations

Forrester Consulting Whitepaper: Securing the Enterprise with Machine Identity Protection
Industry Research

Forrester Consulting Whitepaper: Securing the Enterprise with Machine Identity Protection

Machine Identity Protection for Dummies
eBook

Machine Identity Protection for Dummies

About the author

David Bisson
David Bisson

David is a Contributing Editor at IBM Security Intelligence.David Bisson is a security journalist who works as Contributing Editor for IBM's Security Intelligence, Associate Editor for Tripwire and Contributing Writer for Gemalto, Venafi, Zix, Bora Design and others.

Read Posts by Author
get-started-overlay close-overlay cross icon
get-started-overlay close-overlay cross icon
Venafi Risk assessment Form Image

Sign up for Venafi Cloud


Venafi Cloud manages and protects certificates



* Please fill in this field Please enter valid email address
* Please fill in this field Password must be
At least 8 characters long
At least one digit
At last one lowercase letter
At least one uppercase letter
At least one special character
(@%+^!#$?:,(){}[]~`-_)
* Please fill in this field
* Please fill in this field
* Please fill in this field
*

End User License Agreement needs to be viewed and accepted



Already have an account? Login Here

×
get-started-overlay close-overlay cross icon

How can we help you?

Thank you!

Venafi will reach out to you within 24 hours. If you need an immediate answer please use our chat to get a live person.

In the meantime, please explore more of our solutions

Explore Solutions

learn more

Email Us a Question

learn more

Chat With Us

learn more
Chat