4 ms·
Solution 3: cease trusting StartSSL certs issued before 2014-04-07? This is implied by the request itself but is it possible to implement?
by jl6 13y ago
Solution 3: cease trusting StartSSL certs issued before 2014-04-07?
This is implied by the request itself but is it possible to implement?
- DoubleMalt 13y agoThis is actually not enough as you cannot be sure that certificates generated after that have never been used on a server with a vulnerable OpenSSL implementation.
- throwaway125 13y agoYou can't ever guarantee that for any certificate signed by any CA.
- derefr 13y agoEasily: they could get their upstream CA to revoke their own CA cert, and then get another one. All certs signed by the previous StartCom CA-cert would then be considered revoked.
- antsar 13y agoAnd what about those with StartSSL certs deployed to servers that never were vulnerable to heartbleed? No reason to be needlessly inconvenienced by the poor judgement of others.