Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Situation 1 (safe):

  • Website was vulnerable to heartbleed and using a certificate not valid before 2012-10-21
  • Website upgraded to an unvulnerable version of OpenSSL
  • Website re-keyed and got a their certificate reissued, with with same not-valid-before date of 2012-10-21
  • Today, when I inspect the site, I find it not vulnerable to heartbleed, and using a certificate with a not-valid-before date of 2012-10-21

Situation 2 (unsafe):

  • Website was vulnerable to heartbleed and using a certificate not valid before 2012-10-21
  • Website upgraded to an unvulnerable version of OpenSSL
  • Today, when I inspect the site, I find it not vulnerable to heartbleed, and using a certificate with a not-valid-before date of 2012-10-21

As far as I understand things, these two situations are indistinguishable to me as an end user who has never visited the website in question before. What am I missing?


FYI, situation 1 is apparently the case for *.wikipedia.org. They said that's just the way Digicert reissues certificates.

share|improve this question
    
I disagree - While this IS a security issue, it is also the type of issue of interest to Superuser users, and should remain here. –  davidgo Apr 10 '14 at 7:01
    
We can keep this here. It's on topic for our scope too. If you don't get good answers within, say two days, then we can still migrate it over. –  slhck Apr 10 '14 at 7:49
    
I don't think there actually is a way without knowing the serial number (which you can either compare with the current one or check for in the CRL [List of revoked certs]). –  UKB Apr 10 '14 at 9:56
    
@UKB Thanks! If you're sure of that, could you write an answer? –  user148324 Apr 10 '14 at 14:43
    
@Articuno We actually created a website to track this as best as we could. We grabbed the certs to the top 1 million websites and check to see if they are still vulnerable, and if the cert has changes since we cached it. Heartbleedstatus.com ( I'm not sure it is actually an answer though, so let me know) –  Jacob Apr 12 '14 at 5:33

2 Answers 2

up vote 0 down vote accepted

Zmap.io have a list of changes to certificates for the top 5,000 most popular sites. Note that the date listed there does not rely on the Not Valid Before date of the certificate itself and therefore should represent an accurate date for when the certificate was last changed. (I used Wikipedia.org to check this as they get their certificates from DigiCert who backdate the Not Valid Before date when re-keying certificates.)

They link to the raw data they used which presumably covers a lot more than just the top 5,000 sites but at the time I am writing this, the site is not responding.

Another project that collects certificate fingerprints is Convergence. I haven't explored yet to see if you can extract fingerprints and dates out of it but if you were using it before HeartBleed, it would probably warn you when a site's certificate changed (unless a majority of other people using it had already accepted the new certificate for that site). Ironically, no warning in this situation would be an indication that you were not safe and a warning would be an indication that you were safe.

share|improve this answer
    
This is good. Were any sites doing this all along? It seems like if we wait until after vulnerabilities are announced and responded to, we might lose some of the old certificates if the site responds very quickly to the issue. –  user148324 Apr 14 '14 at 16:00
    
The source data is back online now and it looks like it stretches back for years. It covers the entire IPv4 address space so it's likely to include any site you care about. –  Ladadadada Apr 15 '14 at 12:16
    
Awesome! Seems to me this is a hole in the x.509 specification if we need to rely on a service like this for issue-date determination. –  user148324 Apr 15 '14 at 15:50

You can search for the Certificate Authority's CRL (i.e. http://www.verisign.com/repository/crl.html from VeriSign) and see if they have recently revoked an the old certificate but to do that you will generally need the old certificate's serial number. You could also, if you had the old serial number, just compare it to the new one.

The problem is that there isn't much you can really do to see if it is a different certificate than before without the old certificate serial number.

share|improve this answer
    
Maybe check the internet archive for the site a week ago to see the old cert? –  Dan L Apr 10 '14 at 20:28
    
@DanL Does the internet archive save certificates? –  user148324 Apr 10 '14 at 21:15
    
@Articuno Hmmm, wayback machine doesn't, google cache doesn't. Ok, change the maybe to a don't bother. Sorry about that, should have realized that the secured sites wouldn't let you have a cached version of the page. –  Dan L Apr 10 '14 at 21:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.