News for hackers. Stuff that matters.

A comment on Final Removal of Trust in WoSign and StartCom Certificates. Parent comment

Re:Final Removal of Trust in WoSign and StartCom Certificates by theossuary on Friday July 07, 2017 @12:48PM (#14719858)
It'd be pretty easy to check if the certificate is invalid using something like a bash script [1]. Or you could script ssllabs to check for you (they give the site a failing grade if the Wosign cert is found/invalid) [2].

Note, I haven't been able to test that script on an actually broken site with a Wosign certificate

[1]: https://pastebin.com/ZVMM3PJZ [2]: https://www.ssllabs.com/ssltest/analyze.html?d=google.com&hi...

[ Parent | on HN ]
Re:Final Removal of Trust in WoSign and StartCom Certificates by ivanr on Friday July 07, 2017 @12:59PM (#14719951)
For what it's worth, SSL Labs also has a command-line tool that enables you to scan in bulk https://github.com/ssllabs/ssllabs-scan

However, although they don't trust WoSign and StartCom any more, it's possible that there is a cross-signed certificate to another CA, in which case the problem is not going to be detected. I seem to recollect that such cross-signed certs exist, but I haven't looked for them recently. Will do.

[ Parent | on HN ]