Quick non technical question about Heartbleed Bug

#1

Post by jsanroman » Wed, Apr 09, 2014, 4:38 PM UTC

Do we have to pay to reissue our SSL certificates? If we do then this is the best thing that happened to the SSL certificate vendors and they have all the incentive to be vulnerable

Re: Quick non technical question about Heartbleed Bug

#2

Post by patio11 » Wed, Apr 09, 2014, 4:41 PM UTC

No, you should not have to pay to get an SSL certificate rekeyed. Some providers may ask for money if you want to revoke the cert, if -- for example -- you believe your private keys may have been compromised and you want people's browsers to go nuts if they see that cert in the future, at (for example) a site attempting to MITM you.

Re: Quick non technical question about Heartbleed Bug

#3

Post by rdl » Wed, Apr 09, 2014, 5:16 PM UTC

This depends on which CA you're using. Some do not have a way to reissue/rekey at arbitrary times (StartCom, in particular), and charge for revocation. Most allow free reissue, and often don't charge for revocation and replacement issue.

Re: Quick non technical question about Heartbleed Bug

#4

Post by jsanroman » Fri, Apr 11, 2014, 3:32 PM UTC

patio11 wrote: post #2

No, you should not have to pay to get an SSL certificate rekeyed . Some providers may ask for money if you want to revoke the cert, if -- for example -- you believe your private keys may have been compromised and you want people's browsers to go nuts if they see that cert in the future, at (for example) a site attempting to MITM you.

Thanks!

Re: Quick non technical question about Heartbleed Bug

#5

Post by jsanroman » Fri, Apr 11, 2014, 3:33 PM UTC

rdl wrote: post #3

This depends on which CA you're using. Some do not have a way to reissue/rekey at arbitrary times (StartCom, in particular), and charge for revocation. Most allow free reissue, and often don't charge for revocation and replacement issue.

Thanks!