4 ms·
Either this request is naive, or I am. As I understand it, not all StartCom certificates are necessarily vulnerable. I have a number of StartSSL certificates
by bmelton 13y ago
Either this request is naive, or I am.
As I understand it, not all StartCom certificates are necessarily vulnerable. I have a number of StartSSL certificates issued before 4/7 that, according to the HeartBleed checker here[1] are not vulnerable.
Is it wrong for me to assume that the tool is correct, or is it wrong to assume that all StartCom certificates are necessarily vulnerable?
[1] - http://filippo.io/Heartbleed/ http://filippo.io/Heartbleed/
- DangerousPie 13y agoI don't think the certificates are vulnerable at all. Their private keys may have been stolen if people were using them with a vulnerable version of OpenSSL, but that has nothing to do with StartSSL certificates themselves.
- sigzero 13y agoThat is exactly right and exactly why the bug report was insane.
- Guvante 13y ago> is it wrong to assume that all StartCom certificates are necessarily vulnerable? They aren't claiming all StartCom certificates are vulnerable, they are saying some StartCom certificates may be vulnerable because they impose a fee on revocation.
- ef4 13y agoWhat that tool says is irrelevant to the question of whether those certs have been compromised. The risk is that before the vulnerability was patched, somebody used it to grab the private keys associated with the certs.