I have a free ssl certificate issued just before Heartbleed was found. Now my CA wants me to pay 25$ to revoke it. Should I pay or it's just enough to create a new certificate from another CA an replace existing? Considering there are no real users of my site (the site is still in development and nobody has my old certificate installed in his browser yet)?
2
-
I think you're talking about the StartSSL (StartCom) root certificate? I personally removed it from my trust store, as they'd rather make money out of their users instead of protecting the end-users. Oh well. :P– DitiCommented May 19, 2014 at 9:15
-
Yes, it's StartSSL. I understand they need to make money, but... I feel that my hands are tied in this situation and I don't like it.– droblinCommented May 20, 2014 at 9:57
Add a comment
|
2 Answers
If you did not use your certificate, there is no need to of revoke it or re-issue. Seems to be CA is making more money with Heart Bleed.
If you have used certificate following things could be exposed with exploiting the HeartBleed.
- long-term server private keys
- TLS session keys
- confidential data like passwords
- session ticket keys.
I think there are a couple of misconceptions.
First of all, browsers request and check the certificate on the fly. They do not store it. This can be done manually, but it's neither common nor useful in standard cases.
If anybody has managed to obtain your certificate and the corresponding private key, they now “own” a perfectly valid certificate for your site and can use it whenever they want. It doesn't matter that you've used the certificate only for testing and plan to buy a new one. Browsers aren't aware of this. They will accept either certificate – well, unless your CA explicitly revokes the old one.
So merely buying a new certificate doesn't solve the problem. It doesn't change the fact that there's a potentially compromised certificate which could be used for a man-in-the-middle attack against the site.
It's certainly annoying to pay extra money for the revocation, but there isn't really another option. You should choose a fairer CA next time, though. ;-)
