Re:Ask HN: what happened to LastPass?
by rdl on Friday May 20, 2011 @08:11PM
(#2569873)
Best practice in this case would be to get your new cert from a new CA, then revoke the old one with the original CA once you've got the new cert in place. Plus, of course, announcing everything in advance. (I'd wait a month or so unless you had specific fear of the old one having been compromised).
[ Parent
| on HN ]
Re:Ask HN: what happened to LastPass?
by sixcorners on Saturday May 21, 2011 @06:07AM
(#2570598)
Just wondering.. Why use a new CA?
The new CA won't invalidate your old CA's cert. You want to preserve availability of the old CA's cert until the new one is deployed across all your servers.
In practice, SSL (with CA certified keys issued by lame public CAs) is only really protection from passive eavesdropping anyway; there are enough bad or lax CAs out there that you have to assume an attacker can get a key for an arbitrary site, or can steal a site (not protected in an HSM) from almost any site.
There's nothing really wrong with the X509 PKI in the abstract, but it doesn't really work well for real identity on the Internet. Protection from passive attacks is worthwhile, but it's not worth the disruption to your users to push beyond that to try to keep only one key at a time out there.