Lion Cipher Lab
Find TLS private keys reused across hosts and size the blast radius
- Cyber / Security Engineer
- Intermediate
- ~45 min
- Free · no account required
Why it matters
A TLS certificate binds names to a public key, and whoever holds the matching private key can prove they are those names. Organizations often copy one private key to many places: the same wildcard key on every web server, a load balancer and a VPN appliance; a staging server given the production key 'to make testing realistic'. Each copy is another place the key can be stolen from, and the key is only as safe as its least protected copy. Steal it once, from a forgotten staging box, and you can impersonate every name on every certificate using that key, on every host, until the certificates…
What you'll learn
- certificate fingerprint versus public-key (SPKI) fingerprint
- computing an SPKI hash with openssl
- detecting the same private key on several hosts
- sizing the blast radius of one stolen key
- why one HSM does not protect a key that also lives in files
- how far a wildcard certificate reaches (one label)
- fixing reuse: one key per host or service, and short lifetimes
Steps in this lab
- Identify the key, not the certificate
- See it for yourself with real certificates
- The inventory and the analyzer
- Run it and size the blast radius
- Fix it, and keep it fixed