2

Let's say I had a ca bundle with many certificates in it on my server. I accidentally gave this to a team of programmers I have hired. Could they theoretically use this to somehow ssh into my server or mysql db?

1
  • It depends on the configuration of your services. If you give away secrets that are in use, they may compromise security. – vidarlo Feb 17 at 7:11
2

Could they theoretically use this to somehow ssh into my server or mysql db?

No.

Certificates contain no private keys. The whole purpose of certificates is to be a public information that everyone can freely load from your server to validate the identity of your server.

The CA bundle is just a convenient way to keep the related certificates together instead of looking up every single upstream certificate.

Private key is not a part of CA bundle. That's why no matter how your server is configured giving somebody a CA bundle has no risk at all.

Not only makes it no risk. It makes also little sense to those who get it. Your team of developers should have asked you, for what purpose have you gave them this CA bundle. As long as you give them no private key, this CA bundle is useless. Everyone who needs it will download it from your server, if your server is configured correspondingly. If bundle is not available on your server, everyone can download every single upstream certificate from the web sites of their issuers and thus will get effectively the CA bundle.

Thus you have nothing to worry about.

The only thing to check: Make sure you gave them really CA bundle only. Make sure you have not gave them private key and you have not used wrong wording "CA bundle" for private key.

1
  • great answer, thank you – Secureme Feb 18 at 22:42
2

Did you give them any private keys?

If so, maybe, depending on how your service is set up. You need to immediately revoke the certificates for those keys, and replace the private keys (and certs) with new ones on all your servers.

If not... no. Public keys are, after all, public. Certificates only contain public keys (and some non-key data) and are also public.

1
  • no keys. good to know. thanks. – Secureme Feb 18 at 22:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.