Bug#744027: Revocation Policy

2014-04-10 Thread Raphael Geissert
On 10 April 2014 16:38, Thorsten Glaser wrote: > http://pbs.twimg.com/media/Bk0DY8XCEAAPpS7.png:large You can not expect an implementation that doesn't provide key usage checks to, well, check key usage. That said, even if for instance OpenSSL supports them, applications must tell the library wh

Bug#744027: Revocation Policy

2014-04-10 Thread Thorsten Glaser
Walter Goulet dixit: >offering. I personally have not yet decided if I will indeed revoke, You *must* revoke. http://arstechnica.com/security/2014/04/heartbleed-vulnerability-may-have-been-exploited-months-before-patch/ not only shows that this has been exploited since November, but also contain