4 ms·
You could distrust any certificate that was signed before April 7 (or some slightly later date). It might be easier to do that and whitelist the good "pre-apoc
by gvb 13y ago
You could distrust any certificate that was signed before April 7 (or some slightly later date). It might be easier to do that and whitelist the good "pre-apocalypse" certificates. The nice thing about doing this is that your whitelist will inherently go to zero as certificates time out and get renewed (typically 1-3 years?).
The hard thing would be to generate an accurate whitelist.
- mygrant 13y agoWe had certs that were only used and present on machines that were not vulnerable, and therefore did not replace or revoke them. Please don't do this.
- nathanvanfleet 13y agoFurthermore servers that weren't even using OpenSSL or the particular version(s) that were susceptible. What is the actual percentage of servers that needed to react to this?
- 3pt14159 13y agoI dunno... Probably worth it from a netsec point of view.
- computer 13y agoDoesn't work, since rekeyed certificates are often (mostly?) backdated to have the same valid-from date as the old certificate. I updated my key and certificate, and for the browser-visible certificate metadata only the fingerprint changed.
- jerf 13y agoFor all that you've heard about the disaster side, there's also a huge number of sites that weren't affected. Whitelisting wouldn't help much.