At Jonathan's suggestion, I've used the crt.sh DB to produce this report
of certs that have SAN:dNSName(s) that contain non-permitted characters:
https://docs.google.com/spreadsheets/d/1IACTYMDXcdz4DoMKxkHfePfb5mv2XN68BcB7p6acTqg/edit?usp=sharing
I've only looked at certs for which there's a chain up to a root trusted
by Mozilla, and I've only looked at certs with notBefore dates after 1st
November 2015 (so there's no chance that any of these are "legitimate"
internal server names, per the BRs).
The characters I've treated as permitted are:
A-Z
a-z
0-9
-_.*
So that Symantec's "redacted" precertificates didn't make up 99%+ of the
report, I've also permitted dNSNames to begin with 0 or more instances
of "?.".
--
Rob Stradling
Senior Research & Development Scientist
COMODO - Creating Trust Online
_______________________________________________
dev-security-policy mailing list
[email protected]
https://lists.mozilla.org/listinfo/dev-security-policy
