4 ms·
So, disable SSLv2 and get a new key, and only share it between servers with SSLv2 disabled.
by skykooler 11y ago
So, disable SSLv2 and get a new key, and only share it between servers with SSLv2 disabled.
- pfg 11y agoNote that the private key isn't actually leaked (as opposed to Heartbleed), so it wouldn't be necessary to revoke the old certificate and use a new key. Rather, DROWN uses an existing SSLv2 service with the same key as an Oracle to decrypt (usually secure) TLS connections. It's still a good idea to not share keys to limit the exposure for future attacks.