1

I'm trying to understand the implications of private key leakage (due to Heartbleed) from a website that uses a wildcard certificate.

If an organization has a wildcard certificate (valid for *.domain.tld), does it mean that all sites that use this certificate will have to share the same private key?

  • 4
    They MAY use the same certificate for any *.domain.tld. However, the problem with bugs like heartbleed is that, in case you get hold of the private part of the certificate you are able to intercept (read / modify) any *.domain.tld HTTPS traffic and it doesn't really matter what the originally used certificate is (unless HPKP is enforced). – bayo May 31 '16 at 8:45
  • 1
    @bayo15 You should post this as an answer. – techraf May 31 '16 at 10:30
2

They MAY use the same certificate for any *.domain.tld. However, the problem with bugs like heartbleed is that, in case you get hold of the private part of the certificate you are able to intercept (read / modify) any *.domain.tld SSL/TLS traffic and it doesn't really matter what the originally used certificate is (unless HPKP is enforced).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.