Now this is the definitive answer:
"What to do after upgrading Web Gateway to combat Heartbleed"
Well a lot of work to do...
I'm just wondering if I really have to renew my CA for SSL-Scanning. We use a Sub-CA from our company CA. As far as I know MWG issues certificates for each http-Request for each FQDN (and caches them). So wouldn't it be sufficient to clear the certificate cache to make MWG issue new certificates for each FQDN?
when you access a website MWG creates a server certificate for that website and signs it with the CA you have configured. To do so MWG needs to load the CA certificate and the private key. This means that information is available in the memory. The memory can be read by an attacker in 64kb chunks, so theoretically it might be possible that someone got access to the private key. That means the CA is compromised and someone who stole it could sign certificates with that CA.
To be secure the best approach would be to have your company CA sign a new Sub-CA , import that into MWG and revoke the old Sub-CA. Because the browsers trust the company CA there shouldn't be a need to distribute a new CA to the clients.
I would not continue to use the SubCA certificate. I am going to revoke it.
Someone was able to steal the private key of the SubCA Cert then it is possible to sign new certificates for whatever purpose. That is the reason why in my opinion it is best to revoke this certificate.
What I have seen on a test system:
After the update is finished it cleans out the old certificates that were issued by the SubCA.
According to release notes a reboot is needed to ensure that no running process continues to use the old OpenSSL libraries, but the update does not indicate that a reboot is needed.
Andre was fasterMessage was edited by: sthe / Andre was faster on 4/11/14 2:01:29 PM CEST
Any news about Web Gateway 6.9.x? Yes I know, it's the next thing to migrate but it is still in place as IronMail 6.7.x. For Ironmail, the info is just out, 6.7 is ok but nothing on WebWasher 6.9 yet.
Done the test finally and WebWasher 6.9.6 do not have the affected librairie it seem:
[root@___ ~]# rpm -qa openssl
[root@___ ~]# yum list openssl
Loading "installonlyn" plugin
Setting up repositories
cglinux-base 100% |=========================| 951 B 00:00
cglinux-updates 100% |=========================| 951 B 00:00
webwasher-updates 100% |=========================| 951 B 00:00
Reading repository metadata in from local files
openssl.i586 0.9.7g-cg13 installed