6

I'm trying to increase security for my cloud-based / multi-tenant environment. I'm considering having clients access an obscure URL such as GUID.myCloud.com. I will then respond to that guid-based request with customer-specific data.

  1. Considering that the certificate itself has a Subject name of *.myCloud.com, does that mean that the TLS protocol itself won't expose my private hostname?

  2. Is there any reason to believe that Subject Alternative Names would behave any differently?

makerofthings7
  • 50,918
  • 55
  • 261
  • 556

1 Answers1

5

You'll still see server names in client hello SNI extensions.

Steve Dispensa
  • 3,441
  • 17
  • 20