4 ms·
Ask HN: Certificate Revocation for Heartbleed?
As we all know by now, any certificate potentially exposed via the Heartbleed bug should be revoked, and a new certificate generated. However, certificate revocation appears to be of dubious effectiveness in practice [0]. As a site operator, is there any practical measure I can take to give teeth to a revocation?
[0] http://news.netcraft.com/archives/2013/05/13/how-certificate-revocation-doesnt-work-in-practice.html
- late2part 13y agoYou are at the whims of the clients and the browsers they are using. But, you already are, as they decide whether or not to trust or verify the authenticity of your certificate. You can and should revoke, but it's not clear to me that you can increase the efficacy of that action with your clients.