1

We run a SSL test against our payment server. One of the observations is that it's vulnerable to DROWN attack and report shows that there's 2 of our servers that are sharing the same SSL private key with our payment server.

Sysadmin tells me this is not possible.

Question: How to demonstrate these 2 servers are sharing private key with our payment server?

Improve this question
1
  • 3
    If they have the same private key, then they'll have the same public key. Look at the public key in the certificate in your browser.
    – vcsjones
    Commented Apr 18, 2017 at 18:49

1 Answer 1

Reset to default
2

DROWN does not mean that your servers share the same private key (you would have to copy and paste the keys from one server to the other, more work than just generating a new one) DROWN is about using weak ciphers like SSLv2 export ciphers where known attacks can lead to a decryption on traffic. I would suggest you read that:

How can you proof it? Have a look at the TLS configuration of your vulnerable servers - you will see that legacy ciphers are in use in your config (if not, maybe it's a false positive).

Improve this answer
3
  • Not at all, just using it to harden my crypto
    – slashcrypto
    Commented Apr 18, 2017 at 19:03
  • Typically, we prefer that you explain the general principles while mentioning any specific product/service, rather than "use this product/service!" alone.
    – schroeder ♦
    Commented Apr 18, 2017 at 19:05
  • Slashcrypto, I suggest you to read drownattack.com . It says causes of DROWN attack are: 1. Allow SSL2 connections 2. Sharing private keys with any other servers allowing SSL2.
    – ldkfg
    Commented Apr 18, 2017 at 21:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .