I know of a site that is currently using
SSLv2 and I'm refusing to connect to them until they
- Re-key their servers
I'm insisting on #2 because due to DROWN, servers running
SSLv2 should consider their private keys compromised. A re-key is the only thing that will solve that issue.
Is there a way for me to prove that the site has re-keyed their server? I can check the certificate (which will need to change), but how do I know they didn't just re-use the same key and get a new certificate?
I know I can use
openssl x509 -pubkey to get information about the public key (which is tied directly to the private key) from the certificate. If the public key changes, does that mean that private key has changed?
Or, a better question might be "if the public key changes, is it at all possible that the private key has not changed"? I would compare the public key's modulus and exponent, of course, not just the bytes of the DER-encoded files I was able to fetch or derive.
Will public-key comparison work, and is there a better way?