SSL CA signed certficates

Hi,

My first post to this group, pls bear with me. I'm working with Java
and various network services, some of which are secured with SSL, both
with self-signed and CA signed certificates.

It surprises me that SSL certificates signed by CAs are (fully
qualified) hostname based and not wildcard based, i.e. when I request a
signed certficate I have to state the full name. If I need to secure
another host, I have to generate a new request and have that hostname
signed for as well. This can't be other than a commercially driven
procedure. Surely, if Verisign authenticates company ACNE Inc. and sign
a certificate for foo.acne.com, then what it really /could/ do is sign
*.acne.com and this certificate should be accepted by all clients that
trust Verisign. I guess all SSL APIs are programmed to perform a pure
equality check between DNS name and the certificate's common name, but
what it /should/ do is compare the top-domain/sub-domain (acne.com)
part of the domain name and compare it to the certificate's common name
(which should be acne.com and not having to be foo.acne.com,
bar.acne.com etc).

Why isn't it so? Is it purely commercial, or does it provide any
stronger security this hostname driven signing model?

Any input would be much appreciated.

--

Thomas

.

Relevant Pages

  • Re: Web service Security
    ... Direct Authentication thru SSL ... X.509 certificates ... we need to secure the soap header as well as message itself. ... Is there any effective & secure solution which doesnt use SSL ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: secure without the https???
    ... >>details on always displayed the secure features. ... > will do absolutely nothing to protect you against spyware or the like, ... SSL only gives you protection against sensitive ... handling of certificates. ...
    (alt.computer.security)
  • Re: Ace Password Sniffer : How does it work ?
    ... >> Another protocol that offers same is IPSec. ... >> authentication and secure transfer of data between server and client ... >> would be pretty hard to use SSL to secure data exchanged between ... Once you are done with the secured login, ...
    (microsoft.public.security)
  • Re: [Lit.] Buffer overruns
    ... http://www.garlic.com/~lynn/2001e.html#39 Can I create my own SSL key? ... http://www.garlic.com/~lynn/2001g.html#19 Root certificates ...
    (sci.crypt)
  • RE: Certificate prblems with exchange public folders
    ... c103b404 during accessing Public Folders in Exchange System Manager. ... SSL certificate server name is incorrect" with error code c103b404 stemmed ... Click to clear the Require secure channel check box. ... 8.Restart Exchange System Attendant Service and then restart ...
    (microsoft.public.windows.server.sbs)