1

I'm trying to understand the implications of private key leakage (due to Heartbleed) from a website that uses a wildcard certificate.

If an organization has a wildcard certificate (valid for *.domain.tld), does it mean that all sites that use this certificate will have to share the same private key?

Improve this question
2
  • 4
    They MAY use the same certificate for any *.domain.tld. However, the problem with bugs like heartbleed is that, in case you get hold of the private part of the certificate you are able to intercept (read / modify) any *.domain.tld HTTPS traffic and it doesn't really matter what the originally used certificate is (unless HPKP is enforced).
    – bayo
    May 31, 2016 at 8:45
  • 1
    @bayo15 You should post this as an answer.
    – techraf
    May 31, 2016 at 10:30

1 Answer 1

Reset to default
2

They MAY use the same certificate for any *.domain.tld. However, the problem with bugs like heartbleed is that, in case you get hold of the private part of the certificate you are able to intercept (read / modify) any *.domain.tld SSL/TLS traffic and it doesn't really matter what the originally used certificate is (unless HPKP is enforced).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .