Hiding SANs in the cert

[Alex331]

Hi, I obtained the cert through DNS validation in cert-manager on Kubernetes Cluster. The cert for a couple of domains. Is it possible to hide in SANs the list of the domains in the cert? Maybe someone have simular expirience

[damisanet]

Hi @Alex331,

It is not possible to "hide" domains from SANs list in certificate. The only way to achieve this is to obtain and use separate certs for separate domains.

[jillian]

@damisanet

The only way to achieve this is to obtain and use separate certs for separate domains.

Doing something like this will prevent the SANs of one cert being associated with the other domains on the certificate. However, please remember that all Let's Encrypt certificates are submitted to certificate transparency logs and the domain names will are publicly logged

Certificate Transparency (CT) Logs - Let's Encrypt

[rg305]

First, hello @Alex331, and welcome to the LE community forum

@Alex331

Is it possible to hide in SANs the list of the domains in the cert?

The question seems counterintuitive (to the desired result).
Given: SANs define the names being served by the cert.
If you hide a name from the SAN, it can't be believed when being served via that cert.
I suppose one could propose some method to obfuscate the SAN list, so that only by having a name from the list can the list itself be revealed or individual entry be validated. But we are many revs away from anything even remotely close to that (think: many years from now in a galaxy far far away...).

So, my question is: What exactly do you mean or (better yet) want to do?

[rg305]

If you want a cert that doesn't show your FQDN and but can cover its' use, then try a wildcard cert.
A cert that covers *.your-domain.com will match a bazillion names without ever revealing their existence.

Bazallion in this case is greater than 38^(61 - count.of.chars(.your-domain.com)) * 2^36.

[webprofusion]

count.of.chars is a subdomain, so that needs a new wildcard per level

[rg305]

@webprofusion

count.of.chars is a subdomain

That's just my English for: count the characters in {whatever comes next}
It's just part of the formula.
Some might use:
len(variable or integer or expression)
[length of]

In review, the actual number is likely twice as big as that formula.

[webprofusion]

Yeah I was just trolling

[Alex331]

thank you! My aim is quite simple I want to hide SANs from users. If one of them use sub.domain.com he shouldn't see companyname.domain.com in the cert. But looks like I have only one approach - to create separate certs for each domain. It's could be good, but it's more than 30 additional requests to LE.

[griffin]

@Alex331

But looks like I have only one approach - to create separate certs for each domain.

Or just use wildcard certificates...

@rg305

If you want a cert that doesn't show your FQDN and but can cover its' use, then try a wildcard cert.
A cert that covers *.your-domain.com will match a bazillion names without ever revealing their existence.

[Alex331]

as it was mentioned before, it could be a bit harder 'cause each subdomain of domain requires it's own wildcard, but you're right it is the option too

[Osiris]

@Alex331

cause each subdomain of domain requires it's own wildcard

You mean currently the SAN includes hostnames such as mail.user.example.com and that would require a wildcard hostname like *.user.example.com?

I still fail to grasp why it would be such an issue for the user to be able to see companyname.example.com though..