1. Accidentally publish TLS key on website. 2. Revoke certificate. 3. Get new certificate =WITH SAME KEY=.https://groups.google.com/forum/m/#!topic/mozilla.dev.security.policy/71AXGTgcX9c …
-
-
Replying to @tqbf
Shouldn’t there be a CA rule saying if you revoke a cert, the associated key is blacklisted forever?
3 replies 5 retweets 29 likes -
Replying to @tqbf
Alternative: Every key for every certificate blacklisted for further use.
1 reply 0 retweets 0 likes -
No, thanks. That makes pinning impossible with short-lived certificates.
1 reply 0 retweets 1 like -
I like it even more now! Pinning a key without a timely revocation mechanism is broken, and promotes post-compromise key re-use.
1 reply 0 retweets 0 likes -
Potential compromise is not the reason for pinning, but other CAs issuing is. Short pinning time = less frequent users not protected.
1 reply 1 retweet 0 likes -
Turns out both happen, like that time Heartbleed compromised millions of keys. Long pinning time = downtime if you need to replace the key.
2 replies 0 retweets 0 likes
Besides: you can pin the parent key or the CA if you want to avoid the rogue CA problem.
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.