We run a SSL test against our payment server. One of the observations is that it's vulnerable to DROWN attack and report shows that there's 2 of our servers that are sharing the same SSL private key with our payment server.

Sysadmin tells me this is not possible.

Question: How to demonstrate these 2 servers are sharing private key with our payment server?

  • 3
    If they have the same private key, then they'll have the same public key. Look at the public key in the certificate in your browser. – vcsjones Apr 18 '17 at 18:49

DROWN does not mean that your servers share the same private key (you would have to copy and paste the keys from one server to the other, more work than just generating a new one) DROWN is about using weak ciphers like SSLv2 export ciphers where known attacks can lead to a decryption on traffic. I would suggest you read that:

How can you proof it? Have a look at the TLS configuration of your vulnerable servers - you will see that legacy ciphers are in use in your config (if not, maybe it's a false positive).

  • Not at all, just using it to harden my crypto – slashcrypto Apr 18 '17 at 19:03
  • Typically, we prefer that you explain the general principles while mentioning any specific product/service, rather than "use this product/service!" alone. – schroeder Apr 18 '17 at 19:05
  • Slashcrypto, I suggest you to read drownattack.com . It says causes of DROWN attack are: 1. Allow SSL2 connections 2. Sharing private keys with any other servers allowing SSL2. – ldkfg Apr 18 '17 at 21:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.