4 ms·
What's the certificate info? Most likely, you got a valid cert. MS can give a bit extra security for mistakes like this in their own products because they have
by Sanddancer 11y ago
What's the certificate info? Most likely, you got a valid cert. MS can give a bit extra security for mistakes like this in their own products because they have the keys to the castle, but everyone else will have to use the normal infrastructure, most likely OCSP. But from the sound of things, you're already using the new cert.
https://en.wikipedia.org/wiki/Online_Certificate_Status_Protocol https://en.wikipedia.org/wiki/Online_Certificate_Status_Prot...
- chrisfosterelli 11y agoI imagine I am using the new cert. My question is that if an attacker got a hold of the past one, could I be MitM'd? They removed it from the Windows CTL but didn't mention anything explicitly about revoking it for everyone else...
- johncolanduoni 11y agoMicrosoft issues its own certificates, so if they add it to their own OCSP revocation list it will fail an OCSP check from any device. That said, many browsers don't do OCSP checks or will just accept a certificate if the OCSP server cannot be reached, although this was presumably an EV certificate where that attitude is less common. I'm also guessing this made it into Chrome's CRLSet (this kind of high profile EV revocation is exactly what it was designed for), so if you use Chrome you're pretty likely to be okay. edit: Actually I just checked the Chrome CRLSet, it doesn't appear to have revocations for any certificates from "Microsoft IT SSL SHA2" :(. You can turn on OCSP verification in most browsers, which should do it.
- 0x0 11y agoEV certificates can't be issued for wildcard domains, so probably not EV :)
- johncolanduoni 11y ago:P forgot they said it was a wildcard (it was only in the title, you know).