News for hackers. Stuff that matters.

A comment on OpenSSL Security Advisory. Parent comment

Re:OpenSSL Security Advisory by mvanotti on Thursday July 09, 2015 @03:43PM (#9860236)
So, bad certificate HAS to be signed by leaf certificate, and leaf certificate HAS to be trusted. (And you need two CAs with the same keys)

openssl would accept certs that have been issued by a non-ca cert (which is trusted).

So if you have control over the leaf cert, you can just use it for contacting openssl.

If you don't have control over the leaf cert, you can't issue a bad cert.

Am I missing something?

[ Parent | on HN ]
Re:OpenSSL Security Advisory by caf on Thursday July 09, 2015 @09:34PM (#9861848)
The leaf cert is signed for evil-bastard.net, but the "bad" cert can be for mail.google.com.
[ Parent | on HN ]