FiloSottile / FiloSottile/Heartbleed

Can't test hosts that require client certificate authentication.

Open
#8 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
2.4k
Forks
451
PR merge metrics
No merged PRs in 30d

Description

According to heartbleed.com:

> Does TLS client certificate authentication mitigate this?
>
> No, heartbeat request can be sent and is replied to during the handshake phase of the protocol. This occurs prior to client certificate authentication.

However running this tool against a host requiring client certificate authentication results in:

```
rickette@rickette ~/W/Heartbleed> ./Heartbleed somehost:443
2014/04/08 12:06:18 somehost:443 - ERROR: remote error: handshake failure
```

It works fine if this host doesn't require client authentication

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.