Comment by lmilcin

> This vulnerability affects parsing maliciously crafted certificates, so it will mostly affect clients.

Actually, it is the opposite.

You seem to be unaware of the fact that servers do receive certificates from the clients which are then parsed.

Which is already mentioned in the advisory document:

  "Thus vulnerable situations include:

   - TLS clients consuming server certificates
   - TLS servers consuming client certificates <---- here
   - Hosting providers taking certificates or private keys from customers
   - Certificate authorities parsing certification requests from subscribers
   - Anything else which parses ASN.1 elliptic curve parameters"