4 ms·
Wouldn't LetsEncrypt have to revoke that certificate according to the rules? And I wonder, is having the private key sufficient to eavesdrop on a SSL connectio
by captainmuon 6y ago
Wouldn't LetsEncrypt have to revoke that certificate according to the rules?
And I wonder, is having the private key sufficient to eavesdrop on a SSL connection? If that was the case, this wouldn't help against attackers.
- tialaramex 6y agoHaving a private key is only sufficient to passively eavesdrop TLS 1.2 (and earlier) RSA kex which is not going to happen with any halfway modern browser. You could actively MITM passthrough with the private key on any version, because in this and most cases HTTPS is not mutually authenticated, so the OpenWrt server doesn't know it is talking to your eavesdropping system rather than the web client.
- hannob 6y agoYes. They even have an API to do so, you can revoke any Let's Encrypt certificate with certbot if you have the private key.