Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stackoverflow HTTPS Error – Heartbleed Bug

stackoverflow.com

Post reply on HN
Print view View original

1–10 of 17 posts

Re: Stackoverflow HTTPS Error – Heartbleed Bug

#4

Post by luma »

I don't think this is the bug per se, but it may very well be due to their reaction to the bug. The safe response for secure systems is to reissue certs after patching impacted OpenSSL instances. It looks like they instead have switched over to a previously-issued wildcard cert for *.stackexchange.com. The cert is valid, but it's for the wrong domain.

This is more likely the result of a sysadmin screwing up the response and not bothering to check the work. Maybe s/he should post on stackexchange for some help :D

Re: Stackoverflow HTTPS Error – Heartbleed Bug

#5

Post by gourlaysama »

luma wrote: post #4

I don't think this is the bug per se, but it may very well be due to their reaction to the bug. The safe response for secure systems is to reissue certs after patching impacted OpenSSL instances. It looks like they instead have switched over to a previously-issued wildcard cert for *.stackexchange.com. The cert is valid, but it's for the wrong domain. This is more likely the result of a sysadmin screwing up the respo…

This seems to be the most likely explanation. Serverfault [1] also has switched to that same certificate.

[1] https://serverfault.com/

Re: Stackoverflow HTTPS Error – Heartbleed Bug

#7

Post by AnthonyMouse »

mandlar wrote: post #3

This says it is patched? http://possible.lv/tools/hb/?domain=stackoverflow.com

Patching OpenSSL is only the first step. In theory having operated the servers with an unpatched OpenSSL for some period of time means that your private keys could have been compromised, so to be safe you have to replace your keys and certificates. This appears to be some consequent misconfiguration with the certificates.

Re: Stackoverflow HTTPS Error – Heartbleed Bug

#8

Post by josh-wrale »

jensnockert wrote: post #2

What am I supposed to see? I just get an invalid certificate? Or is that what I am supposed to see?

It looks like they self-issued new certs after patching their servers: A radical move, if that's the case, but it's probably justified given the scope of the bug.

Edit: Looking closer at the invalid cert, it appears to be a host name conflict, not a self-issued cert. This is probably a result of the rush to re-issue.

However, BEWARE! Invalid certs are nearly always suspicious!

Re: Stackoverflow HTTPS Error – Heartbleed Bug

#9

Post by josh-wrale »

josh-wrale wrote: post #8
jensnockert wrote: post #2

What am I supposed to see? I just get an invalid certificate? Or is that what I am supposed to see?

It looks like they self-issued new certs after patching their servers: A radical move, if that's the case, but it's probably justified given the scope of the bug. Edit: Looking closer at the invalid cert, it appears to be a host name conflict, not a self-issued cert. This is probably a result of the rush to re-issue. However, BEWARE! Invalid certs are nearly always suspicious!

luma has the answer further down the thread. I didn't look at the date. I should really return to caffeine after many years away from it. lol
Post reply on HN