7
votes
2answers
338 views

How can we revoke all ssl certificates issued for our domain?

After having the hostmaster@domain.com email compromised, we found that someone issued a Domain Validated SSL certificate for our domain. Now we want to have all such certificates revoked. Is there ...
1
vote
2answers
86 views

A doubt in certificate chain validation and revocation checking

So when i do a tls handshake with the server, it responds with a cert chain which the browser verifies and which ends at a trusted root CA. In this the browser checks if the cert presented by the ...
7
votes
1answer
267 views

How can I verify if a website revoked its old SSL certificate keys? [duplicate]

Through reading from multiple sources and watching Security Now's How the Heartbleeds, I have come to the understanding that the following procedure is recommended to be safe from the Heartbleed ...
1
vote
2answers
309 views

SSL cert minimize downtime key rotation strategy

As you already know, due to the heartbleed bug, we need to perform re-keying on our web servers (>10), before I do that, I want to check if my proposed strategy is a proper way or not a. Generate a ...
3
votes
3answers
1k views

Revoke a certificate without index.txt

I generate self-signed client certificates for a little Apache server hosted under my stairs. The script below was hacked together for this purpose - note it uses the 'mini-CA' x509 method, therefore ...
5
votes
3answers
563 views

Why do we allow SSL certificates to be replaced before their expiry date, without revokation of others?

Imagine a situation where a rogue CA creates a certificate for your site. Since the user's browser trusts the CA, it will accept the certificate without any fuss. However, the site's real certificate ...
2
votes
2answers
3k views

Ssl certificate rekey or revoke

I want to be sure to understand well the situation where SSL certificate is compromised. If I ask for a rekey, I suppose the old certificate will remain valid. The future communications with the new ...
13
votes
3answers
224 views

Domain name expiration and TLS

If I purchase a domain name that has expired, do I have any assurance that the previous owner does not have a valid HTTPS certificate for the site? In other words, do CAs check domain name expiration ...
9
votes
1answer
341 views

Why can the validity of an SSL certificate exceed the registration period of a domain?

I can understand why one might desire to purchase a certificate for multiple years but I am left wondering why it appears to be possible to obtain a valid certificate for a domain that may have come ...