2

the lastpass.com/heartbleed tool states that my server is most likely vulnerable and that users should wait untill my cert has been replaced.

It seems that they check for certificate creation date, but i re-keyed my certs which means that they are newly created with a new key but still have the old information like the original creationdate from 2013.

Is there a way to check if a certificate has been rekeyed?

EDIT (clarification): If you have access to both certs you can tell the difference and compare it to the cert you see in the browser, but that's not possible for normal visitors to the site. If I browse to a website I want to be able to check if the cert has been replaced or re-keyed.

|improve this question
  • Check the thumbprint, it is unique per certificate. – Neophyte Apr 11 '14 at 7:27
  • The problem is, that you would need to know the thumbprint of the old certificate. I can do this on my server, but not on websites I visit. – mohrphium Apr 11 '14 at 10:09
  • Huh, what CA are you using? GoDaddy uses a proper notBefore date; this is what I used to check. – mirabilos Apr 13 '14 at 10:03
  • I bought a comodo cert at checkdomain.de. It's pretty cheap, so maybe thats why. – mohrphium Apr 13 '14 at 12:27
0

From what I've found so far it's not possible unless the certificate is replaced with a completely new one and has a new creation date.

The only differences between the old and the new certificates are the lines that come after

Serial Number: Modulus: Signature Algorithm:

and the ---BEGIN CERTIFICATE--- ... --- END CERTIFICATE ---- part.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.