On April 7, 2014, a vulnerability in the OpenSSL cryptographic library was announced to the Internet community. Aptly labeled as the Heartbleed bug, this vulnerability affects O…
PKI Consortium blog
Posts by tag Attack
CA Security Council (CASC) members Trend Micro, Go Daddy, and Symantec participated in a discussion panel at the 2014 RSA Conference in San Francisco on February 24 entitled “Ne…
Google
Netcraft has published an article stating they have found many bogus SSL certificates. In this case, a bogus certificate is self signed (i.e., not issued from a legitimate certi…
SSL/TLS
Previously, we advised that the [SSL industry must move to the SHA 2 hashing algorithm][1] for certificate signatures. We thought it would be helpful to provide the reasoning be…
We have seen recently that Google detected that publicly trusted TLS/(SSL) certificates had been created for Google domains without having been requested by Google themselves. T…
Code Signing
Looking Back at 2013 Protocol Attacks The year started with a couple of SSL/TLS protocol attacks: [Lucky Thirteen][1] and [RC4 attack][2]. Lucky Thirteen allows the decryption o…
Internet Surveillance The big news at [IETF 88 in Vancouver][1] was the technical plenary on [Hardening the Internet][2] which discussed the issue of pervasive surveillance. Per…
Attack
In a previous post titled [Getting the Most Out of SSL Part 2][1] , we touched on the recommendation that Web servers be configured to prefer Transport Layer Security (TLS) vers…
As originally architected by Netscape and others in the mid 1990s, the certificate issuance process envisioned that the CA would present the certificate and its contents to the …
They say the most complicated skill is to be simple; despite SSL and HTTPS having been around for a long time, they still are not as simple as they could be. One of the reasons …
