DNS resolution and SSL coverage for multi level subdomain wildcard

[mallen1]

What is the name of the domain?

https://aa.bb.cc.ezfacility.com/

What is the error message?

net::ERR_CERT_COMMON_NAME_INVALID

What is the issue you’re encountering

DNS is resolving and SSL does not cover domain. Reported by ASV scanner as vunlerability.

What steps have you taken to resolve the issue?

Opened support case.

What are the steps to reproduce the issue?

We have a wildcard CNAME rec in DNS for *.ezfacility.com. This is required for our application.
Goto https://aa.bb.cc.ezfacility.com in browser, get certificate warning. Note this is multi level subdomain.
Confirm warning. and final page displayed is “403 Forbidden, cloudflare” page.

Our ASV picked a random multi level subdomain and marked it as a vulnerability. I chose aa.bb.cc at random–anything will trigger the same behavior.
Ideally only .ezfacility.com would resolve in DNS, not ...ezfacility.com.

[Laudian]

@mallen1

Ideally only .ezfacility.com would resolve in DNS, not ...ezfacility.com.

Then you need to create individual records instead of a wildcard.

[mallen1]

Sounds like what I want is not possible. It would not be viable to guess all of the random combinations, and I’m forced to use the wildcard per our app. For now I’ll just cover the multi-level domain that was randomly chosen and mark the vulnerability as solved.