HexBrain

Ian Dunn · Report #150078

SSL certificate public key less than 2048 bit

N/Astatus
4upvotes
18 Aug 2016disclosed

How it was found

One of the SSL certificates used by your SSL server (On your personal website: https://iandunn.name/ ) contains a public key less than 2048 bit long.

New Standard for SSL Certificates Industry standards set by the Certification Authority/Browser (CA/B) Forum require that certificates issued after January 1, 2014 MUST be at least 2048-bit key length.1 As computer power increases, anything less than 2048-bit certificates are at risk of being compromised by hackers with sophisticated processing capabilities. The cybersecurity industry is moving to stronger 2048-bit encryption to help preserve internet security.

Any certificate with a public key less than 2048-bit are at risk of being compromised by hackers with sophisticated processing capabilities.

If you have any 1024-bit certificates or certificates with less than 2048-bit key length, you will need to migrate to 2048-bit key length.

http://www.geotrust.com/resources/2048-bit-compliance/

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original