Though I guess what they could do in such a scenario is implement a service whic... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

		baudehlo on July 7, 2015 \| parent \| context \| favorite \| on: Forthcoming OpenSSL releases Though I guess what they could do in such a scenario is implement a service which uses the signing server and hope to run undetected. Yes?

wolf550e on July 7, 2015 [–]

Yes. My first idea to detect this is keep count of signatures performed on the private key holding server and count of tls handshakes on your webserver.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact