VeriSign offering free re-issues of SSL certificates

In response to the mess created by the OpenSSL vulnerability in Debian-based Linux distributions, the folks at VeriSign are offering to re-issue SSL certificates to any of its customers who believe their certificates may have been compromised. VeriSign officials say that none of the certificates issued by its brands, including GeoTrust, thawte, RapidSSL and VeriSign, is affected directly by the flaw, but customers who use one of the affected Linux distributions could have used that OS to generate key pairs for one of the certificates, which would in turn make the certificate vulnerable.

The implications of the OpenSSL flaw are far-reaching and security experts say that it’s difficult to know how many users are affected and whether there have been any widespread attacks exploiting the problem. But there have been some reports of isolated attacks, so it’s wise to update your certs and encryption keys as soon as you can.