Certificate Authorities to push for better certificate-revocation checking
The newly formed Certificate Authority Security Council will raise awareness about OCSP stapling
IDG News Service - Several Certificate Authorities (CAs) have formed an advocacy group called the Certificate Authority Security Council (CASC), which will focus on promoting new security standards, policies and best practices for SSL (Secure Sockets Layer) deployment on the Web.
CASC was launched on Thursday and its member list includes representatives from Symantec, Trend Micro, Comodo, DigiCert, Entrust, GlobalSign and Go Daddy. CAs are organizations that issue digital certificates.
The group's first efforts will focus on educating Web server administrators, software vendors, browser developers and end users about the importance of certificate-revocation checking and the benefits of adopting and implementing a mechanism called OCSP stapling -- OCSP stands for Online Certificate Status Protocol.
Ensuring that certificate-revocation information reaches users in a timely manner is very important, especially in light of several security breaches that affected Certificate Authorities during the past few years and resulted in rogue certificates for high-profile domains being issued fraudulently.
CAs use two mechanisms to announce certificate revocations: certificate-revocation lists (CRLs) that are updated periodically and OCSP responders -- servers that respond on-the-fly to certificate-revocation checks initiated by clients.
When encountering a digital certificate, modern browsers first verify that it is signed by a trusted CA and then send an OCSP request to that CA's OCSP responder in order to check if the certificate is still valid -- whether it has, for example, expired or has been revoked for some reason.
However, if their OCSP and CRL requests fail because of network errors, most browsers will, by default, accept the certificate and proceed to establish the connection. This is a soft-fail approach that favors usability over security.
For example, an attacker who has the ability to launch a man-in-the-middle attack using a rogue digital certificate can intercept the OCSP requests of the victim's browsers and block them, forcing the browser to accept the certificate even if the issuing CA revoked it in the meantime.
OCSP also raises privacy concerns because by contacting the CA to check the validity of a certificate, the browser indirectly tells the CA that the user visited a certain website.
OCSP stapling resolves both the security and privacy issues of current OCSP implementations, because the client no longer contacts the CA's OCSP responder directly. Instead, the HTTPS server queries the OCSP responder periodically and caches a signed and time-stamped response which is then included -- stapled -- in the SSL handshake with clients.
OCSP stapling also improves performance because it decreases the time required to establish a HTTPS connection by eliminating the additional request sent by the client to a third party.
"The CASC plans to educate affected parties in the coming months through blog posts, conference presentations, and other resources that will help people learn about OCSP stapling and make it easier for web server administrators to understand how to enable OCSP stapling on their servers," CASC said Thursday on its website. "We also plan to encourage wider adoption of this critical technology among software vendors and browsers."
- Securing Mobility, From Device to Network At one time, the process of managing and securing mobile devices and applications was fairly straightforward. Most organizations worried about one application (email)...
- Data Protection eGuide In this eGuide, CSO and sister publications IDG News Service, Computerworld, and CIO pull together news, trend, and how-to articles about the increasingly...
- Warning: Cloud Data at Risk Experts agree that relying on SaaS vendors to backup and restore your data is dangerous. Yet that's exactly what huge portions of the...
- The Opportunities and Challenges of the Cloud In this report F5 poses questions to IDC analysts, Sally Hudson and Phil Hochmuth, on behalf of F5's customers to better understand the...
- Live Webcast Security Vulnerabilities Associated With Having Local Administrator Privileges Viewfinity will demonstrate how removing admin rights and granularly managing privileges at the application level reduces the attack surface.
- Live Webcast IBM FlashSystem V840: Leveraging Software-Defined Flash to Drive Your Business With end-to-end, tightly integrated functionality and super-fast flash technology, products like IBM FlashSystem V840 Enterprise Performance Solution empower businesses to leverage the efficiency...
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different....
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!