4 ms·
Do browser-generated SSL client certs really share keypairs between unrelated domains? AFAIK, each one asks the browser to generate a new keypair. Unless of co
by ef4 15y ago
Do browser-generated SSL client certs really share keypairs between unrelated domains?
AFAIK, each one asks the browser to generate a new keypair. Unless of course they've chosen to be federated with someone who has already issues you a cert.
- marshray 15y agoYes, browsers can be a bit promiscuous with who they hand your client cert to. It depends on the browser, who issued the cert, and what websites the user has agreed to supply their client cert for. If a specific website issued the cert, it won't be terribly useful to another site, but it could leak some personal info. If a well-known CA (e.g. DigiNotar) issued the cert, it might be valid across a wide range of sites (e.g. Dutch government and other sites). The TLS protocol is a bit lacking in this regard. A man-in-the-middle type attacker can impersonate a server to a browser and get the "public" client cert.