Re: Multi-domain security certificate

Thomas, if it makes you feel better, just know that you aren't the only 
one with these certificate problems.

We host a bunch of domains, most of them are third-level domains, and 
not all of them are sub domains of the same second-level domain.  We've 
just grown to accept the fact that our certificate(s) will never match 
the majority of our domains.

By using the certificate as a way to authorize the domain and its 
components, it really only works [the way it's intended] if you use a 
wildcard certificate and you have a standard-layout single second-level 
domain installation.  It's very difficult for non-standard installations 
(such as you) and for hosting providers of multiple disparate domains 
(such as us) to get matching certificates for every domain and component.

The last I checked, even Google hasn't solved this problem.  They use a 
single certificate (talk.google.com, I think) for all of their hosted 
domains.

Because of these issues, I doubt that enforcement of certificates 
matching the domains will ever fully succeed.

On a bright note, iChat and Adium have good key management strategies 
that allow the user to import the certificate into the keychain as 
"trusted" for the domain.

Jesse


Peter Saint-Andre wrote:
> Thomas Arnoux wrote:
>> On Thu, 2009-01-22 at 11:12 +1100, David Banes wrote:
>>> You need to get a wildcard certificate for 'foo.com'.
>> Hi David,
> 
> First of all, the best way to get your questions about the XMPP ICA
> answered is to ping me via IM. That's why I put my name on the CA pages
> at http://xmpp.org/ca/ :)
> 
>> Thanks for your answer, but I cannot have a a certificate for *.foo.com
>> (I do not own/control foo.com, and its owner will give me access to only
>> *.muc.foo.com and *.im.foo.com (or without the wildcards), not to
>> *.foo.com).
> 
> StartCom (and therefore the XMPP ICA) will not issue certificates to
> third-level and fourth-level domains, at least not directly, because we
> cannot verify your association with the first-level domain. The only way
> to do this is to convince the owner of the first-level domain to let you
> request such a cert (e.g., the verification message will go to an email
> address such as [email protected] and the person who controls that
> inbox will forward the message to you). I don't know whether you have
> that kind of trust relationship with the owner of the first-level domain.
> 
>> Documentation about all of this is very scarce, and the simplest process
>> on startcom's website (with CSR generation) doesn't seam to allow
>> creation of wildcards on the fourth level DNS name, nor multi-domain
>> certificates.
> 
> Correct.
> 
>> Is it possible to get one single certificate for all domains (with and
>> without their wildcards), or to use several certificates (with
>> ejabberd)?
> 
> Not from StartCom via the XMPP ICA.
> 
>> Is the manual CSR generation exactly the same as for SSL certificates (I
>> couldn't find anything else on Google)?
> 
> Yes. I'll add something about that to http://xmpp.org/ca/issuance.shtml
> 
> /psa
> 
> _______________________________________________
> JAdmin mailing list
> FAQ: http://www.jabber.org/discussion-lists/jadmin-faq
> Forum: http://www.jabberforum.org/forumdisplay.php?f=19
> Info: http://mail.jabber.org/mailman/listinfo/jadmin
> Unsubscribe: [email protected]
> _______________________________________________

-- 
   Jesse Thompson
   Division of Information Technology, University of Wisconsin-Madison
   Email/IM: [email protected]

_______________________________________________
JAdmin mailing list
FAQ: http://www.jabber.org/discussion-lists/jadmin-faq
Forum: http://www.jabberforum.org/forumdisplay.php?f=19
Info: http://mail.jabber.org/mailman/listinfo/jadmin
Unsubscribe: [email protected]
_______________________________________________