Through reading from multiple sources and watching Security Now's How the Heartbleeds, I have come to the understanding that the following procedure is recommended to be safe from the Heartbleed vulnerability (assuming that the user's browser reacts correctly to revoked TLS certificates, which I know may not be the case for all browsers right now, but let's leave this issue aside for the moment):
- Upgrade to a patched version of openssl
- Regenerate the TLS certificate (rekey)
- Revoke the previous certificate
Doing the previous steps would:
- Prevent exploitation of the Heartbleed vulnerability to steal the new key (because of 1. and 2.)
- Protect users from Man in the Middle attacks using a stolen key (because of 3.)
Now, I know that there are multiple tools to see if a website is currently unsafe (1. did not update) or potentially vulnerable (2. did not rekey), but how can I know if a website revoked its previous certificates?
I believe I could check for a specific key (if it is known) using tools (which I assume use OCSP or CRLs), but is there a way to access previous keys of a website?
It is purely out of curiosity, but I would like to verify when a website says
"we are safe now" that they really did revoke their certificates as well as update openssl and regenerate the keys.
Thank you very much for your precious time and pardon the potential mistakes caused by my lack of knowledge in the field of information security.