OpenSSL Heartbleed Security Update

Post by grittygrease » Tue, Apr 08, 2014, 6:46 PM UTC

dpiddy wrote: post #11

gojomo wrote: post #2

Loading an https://APPNAME.herokuapp.com page, I'm seeing a certificate (sn:"0E:3E:94:7F:C0:64:D7:4A:52:B1:38:D7:71:90:88:1F") with an "Issued Date" of "1/20/14"... which doesn't sound like it's been regenerated in the last 24 hours. Am I interpreting the certificate info wrong? [edit per official answer below: YES] (Are fresh certificates sometimes given much older start times? [edit: YES] ) This blogpost doesn't cl…

Hi, Heroku engineer here. We rekeyed our certificates, including the one for *.herokuapp.com, meaning we resent our original certificate requests (CSR) to our CA but signed with new private keys. This is why the dates didn't change. Our CA will eventually revoke the previous incarnations of our certificates, signed with the old private keys, making them invalid.

Post by grittygrease » Tue, Apr 08, 2014, 6:52 PM UTC

schrodinger wrote: post #22

grittygrease wrote: post #21

Earlier quoted context omitted.

This is completely the wrong approach. Your private key might have been compromised and you're generating another certificate for the same compromised private key? What is that supposed to do?

I think you misread... the poster said they used a new private key with the same CSR.

Post by grittygrease » Tue, Apr 08, 2014, 7:14 PM UTC

dpiddy wrote: post #24

grittygrease wrote: post #21

Earlier quoted context omitted.

This is completely the wrong approach. Your private key might have been compromised and you're generating another certificate for the same compromised private key? What is that supposed to do?

As discussed on twitter ( https://twitter.com/grittygrease/status/453606054698692608 ), I should have said: We generated new CSRs, with new private keys, but with the same dates and details as the originals. This let us get fresh certs without going through a full renewal. Thanks for the prod.

Post by maxerickson » Tue, Apr 08, 2014, 7:28 PM UTC

diminoten wrote: post #26

The one thing that might be of some small comfort to others is the fact that at least the NSA didn't know about this bug. If they had, there wouldn't be any talk of HTTPS being a barrier in their leaked presentations. That said, all of that encrypted traffic they've got stored up can now, thanks to this bug, be decrypted.

Post by mpyne » Tue, Apr 08, 2014, 8:36 PM UTC

maxerickson wrote: post #27

diminoten wrote: post #26

The one thing that might be of some small comfort to others is the fact that at least the NSA didn't know about this bug. If they had, there wouldn't be any talk of HTTPS being a barrier in their leaked presentations. That said, all of that encrypted traffic they've got stored up can now, thanks to this bug, be decrypted.

I would think that when they discover a superpower they compartmentalize that information. You could make the inference that, if they did have it, they were not making broad use of it.