Here is another consequence of the Debian OpenSSL security bug that I did not hearabout (or realize) until recently: it lets an attacker steal any ofyour SSL certificates that were created with the broken (weak) OpenSSLversions. This includes signed certificates, with all that thatentails .

How the attacker does it is simple. They get your actual certificatesimply by connecting to your SSL-protected service (such as yourwebsite); the SSL protocol exchange necessarily sends them a copy ofyour certificate, complete with

I have a new-found interest in finding outwhat ciphers various SSL servers around here are using in some easy andconvenient way. Doing this in Perl is easy (there's an example here ), but I prefer Python.I'd normally use pyOpenSSL , my favorite Python OpenSSL module , butunfortunately it doesn't (currently) have an interface to thenecessary 'get the connection's cipher' OpenSSL routine, andthere's no visible substitute for it.

(While the .get

Suppose that your web server's SSL certificate's private key iscompromised and stolen by an attacker. Further suppose that you detectthis and replace the compromised certificate with a new one. Now, here'sa question: what damage can the attacker still do with their stolencertificate?

• they can impersonate your web server. In theory they can only do thisuntil their stolen certificate expires; in practice, I think that manyusers ignore 'expired certificate' errors because they are relativelycommon.

  (SSL certificate