FiloSottile / FiloSottile/Heartbleed
Can't test hosts that require client certificate authentication.
Open
- Dominant language
- Go
- Stars
- 2.4k
- Forks
- 451
- PR merge metrics
- No merged PRs in 30d
Description
According to heartbleed.com:
> Does TLS client certificate authentication mitigate this?
>
> No, heartbeat request can be sent and is replied to during the handshake phase of the protocol. This occurs prior to client certificate authentication.
However running this tool against a host requiring client certificate authentication results in:
```
rickette@rickette ~/W/Heartbleed> ./Heartbleed somehost:443
2014/04/08 12:06:18 somehost:443 - ERROR: remote error: handshake failure
```
It works fine if this host doesn't require client authentication
Contributor guide
Assessment
This issue has not been assessed yet.