Sep 10, 2018
A group of researchers have discovered a technique that uses DNS queries to trick Certificate Authorities into issuing fraudulent SSL certificates.
seen from United States
seen from China
seen from China
seen from Switzerland
seen from United States
seen from Malaysia
seen from Malaysia
seen from United States
seen from Germany
seen from Italy
seen from Belgium
seen from United States
seen from Singapore
seen from Germany
seen from United States
seen from Denmark
seen from Canada
seen from United States
seen from United States
seen from United States
A group of researchers have discovered a technique that uses DNS queries to trick Certificate Authorities into issuing fraudulent SSL certificates.
New changes to the CAB Forum's baseline requirements became active August 1st. CAs may no longer use WHOIS or legal opinions for domain validation.
New Post has been published on EDZTECH
New Post has been published on https://edztech.org/are-all-ssl-certificates-the-same/
Are All SSL Certificates the Same?
The number of businesses that use SSL have increased tremendously over the past few years and the reasons for which SSL is used has also increased, for example:
Some businesses need SSL to simply provide confidentiality (i.e. encryption)
Some businesses like to use SSL to add more trust or confidence in security and identity (they want you to know that they are a legitimate company and can prove it)
As the reasons companies use for SSL have become wider, three different types of SSL Certificates have been established:
Extended Validation (EV) SSL Certificates
Organization Validation (OV) SSL Certificates
Domain Validation (DV) SSL Certificates
Extended Validation (EV) SSL Certificates are issued only when a Certification Authority (CA) checks to make sure that the applicant actually has the right to the specific domain name plus the CA conducts a very THOROUGH vetting (investigation) of the organization. The issuance process of EV Certificates is standardized and is strictly outlined in the EV Guidelines, which was created at the CA/Browser Forum in 2007, specifies the required steps that a CA must do before issuing an EV certificate:
1. Must verify the legal, physical & operational existence of the entity
Must verify that the identity of the entity matches official records
Must verify that the entity has the exclusive right to use the domain specified in the EV Certificate
Must verify that the entity has properly authorized the issuance of the EV Certificate
EV Certificates are used for all types of businesses, including government entities and both incorporated & unincorporated businesses. Takes about 10 days to issue.
A second set of guidelines are for the actual CA and it establishes the criteria to which a CA needs to be audited before being allowed to issue an EV Certificate. It is called, the EV Audit Guidelines, and they are always done every year to ensure the integrity of the issuance process.
Organization Validation (OV) SSL Certificates are issued only when a Certification Authority (CA) checks to make sure that the applicant actually has the right to the specific domain name plus the CA does some vetting (investigation) of the said organization. This additional vetted company info is displayed to customers when the Secure Site Seal is clicked on, this gives enhanced visibility to who is behind the site which in turn gives enhanced trust in the site. Takes about 2 days to issue.
Domain Validation (DV) SSL Certificates are issued when the CA checks to make sure that the applicant actually has the right to the specific domain name. No company identity information is vetted and no information is displayed other than encryption information within the Secure Site Seal. DV certs can be issued immediately.
Email newsletter and sign up options are most important in web. But how to determine given email and domain is valid? How to know DNS MX record by PHP?