4 ms·
The first graph shows an interesting bump in SSL cert reissue activity on April 2nd - 5 days before public disclosure. Could this be the day Google, CloudFlare
by nnx 13y ago
The first graph shows an interesting bump in SSL cert reissue activity on April 2nd - 5 days before public disclosure.
Could this be the day Google, CloudFlare, and other major internet companies in-the-know before the public disclosure, patched their servers?
Is this graph generally available, for any time range, from NetCraft or another monitoring service?
I'm aware the graph shown has a time range too narrow to conclude anything but this made me think that monitoring this graph or noticing unusual reissues from major internet services (Google/CloudFlare/AWS/Facebook) could be used as an advance warning mechanism that a significant SSL flaw is about to be publicly disclosed.
- Maxious 13y ago"We fixed the flaw on Monday March 31, 2014 for all CloudFlare customers, with public notification on Monday April 7, 2014, after the researchers' public announcement." https://support.cloudflare.com/hc/en-us/articles/201660084-Update-on-the-Heartbleed-OpenSSL-Vulnerability https://support.cloudflare.com/hc/en-us/articles/201660084-U...
- nnx 13y agoYou are right to point out that the date they patched their servers does not necessarily coincide with the date they reissued their certificate. Unfortunately, it seems CloudFlare's new cert keeps the same dates as their previous one so only the serial number has changed afaik. On the other hand, I just checked and indeed Google did reissue certs for most if not all of their domains on April 2nd http://pastebin.com/5Ry7XRAZ http://pastebin.com/5Ry7XRAZ