4 ms·
But have you revoked your old primary keys? Everybody that was vulnerable to Heartbleed should revoke their old primary keys so that web browsers no longer tru
by gvb 13y ago
But have you revoked your old primary keys? Everybody that was vulnerable to Heartbleed should revoke their old primary keys so that web browsers no longer trust those potentially stolen keys. If they are not revoked and a Bad Guy stole your primary key(s), they can create a fake web site that identifies itself as your web site and all web browsers would trust it as legitimate, complete with the little green "you can trust me" padlock.
The CloudFlare challenge proved that the primary keys could be stolen.
There were millions of vulnerable sites (the internet is approaching a billion total web sites, and a significant number of them were vulnerable). The revocation list method used by browsers does not scale well with those kinds of numbers.
[1] http://news.netcraft.com/archives/category/web-server-survey/ http://news.netcraft.com/archives/category/web-server-survey...
- schrodinger 13y agoDoesn't rekeying result in the old certificate based on the compromised private key being revoked?
- mpyne 13y agoNo, presenting a certificate that has been rekeyed does not mean that the old certificate stopped being cryptographically valid. In fact the old cert will always be cryptographically valid, which is why a separate revocation list has to be created as a positive acknowledgement that the old cert, though valid, should not be trusted.
- lmz 13y agoDo the browsers actually use revocation checking?
- schrodinger 13y agoI understand that, but I thought in practice most CAs will automatically revoke the former certificate when rekeying. It sounds like godaddy does, at least.
- mpyne 13y agoThat's up to the CA. It seems that StartSSL doesn't automatically revoke an old one even with rekeying.
- falcolas 13y agoYup, as part of the cert re-issue, we revoked the previous cert. Could have been more explicit there, sorry.