Deprecation of certificates for internal needs 21/02/2019 Deprecation of certificates for internal needs

Reserved IP address range WHY? Not directly linked to the launch of new domain names extensions! The decision was made in June 2012 by CA/B forum Main reason: security issue Short version => Local domains are not unique, unlike public domains or public IPs, so they cannot be vetted by CAs + the launch of new gTLDs can create collisions between a local domain and a public domain WHAT IS PUBLIC, WHAT IS PRIVATE? https://ssl247.co.uk <<< Public domain name (aka FQDN) Reserved IP address range 10.0.0.0 - 10.255.255.255 172.16.0.0 - 172.31.255.255 192.168.0.0 - 192.168.255.255 https://ssl247.lan <<< Private domain name (aka local domain) 88.208.246.30 <<< Public IP address 192.168.0.1 <<< Private IP address (aka reserved / local IP) prod-cft-1 <<< Machine name (always private) /!\ There are exceptions. Any doubt, consult this page: http://en.wikipedia.org/wiki/Reserved_IP_addresses#Reserved_IPv4_addresses

Nameserver’s cache database Long version => 2 examples 1.Let’s say Barclays has deployed an internal mail system at the address https://mail/ Legitimate server The system is not reachable from the public Internet – only on the local corporate network or over the VPN The name mail is not unique, so anyone can potentially obtain a certificate that validates for https://mail/ https://mail/ Employee’s computer If you bring such a certificate into Barclay’s network, it can be used in combination with local name spoofing* to perfectly impersonate the real corporate mail server and steal users’ credentials and other confidential information. Hacker’s server Nameserver’s cache database https://mail/ *DNS spoofing (or DNS cache poisoning) is a computer hacking attack, whereby data is introduced into a Domain Name System (DNS) name server's cache database, causing the name server to return an incorrect IP address, diverting traffic to another computer (often the attacker's).

Employee’s laptop asking to see the page 2.Let’s say Barclays has deployed an internal mail system at the address https://webmail.barclays.corp Local server https://webmail.barclays.corp ICANN decides to launch .corp as a new extension Employee’s laptop asking to see the page https://webmail.barclays.corp A hacker registers the domain Barclays.corp, and issues a DV certificate to secure it. The hacker perfectly impersonates the real corporate mail server and uses DNS cache poisoning attacks to redirect people to the hacker’s server. The attacker might not even need to be on the corporate network to mount a successful attack. If a user connects their corporate laptop to a public WiFi network, the mail client might automatically attempt to connect to “https://mail/” or” https://webmail.barclays.corp“ before a VPN connection is established. If an attacker has anticipated this, again, a perfect impersonation can be made. Hacker’s server https://webmail.barclays.corp

WHAT? All our CAs will respect the deprecation To be deprecated Local domains Local IPs Server names https://ssl247.lan 192.168.0.1 prod-cft-1 Not deprecated Public domain names Public IPs https://ssl247.co.uk 88.208.246.30

WHEN?

BATTLE PLAN MARKETING SIDE Blog article: being translated into all languages https://www.ssl247.co.uk/about/blog/Deprecation-of-ssl-certificates-securing-internal-domains-why-when-and-what-to-do DotMailer campaign: being translated into all languages To be sent on Thursday (Sept 11) http://dmtrk.com/t/M42-2SDXD-BDC5RL8OD3/cr.aspx

SALES SIDE: CLIENTS FIRST! Certificates expiring before 01.11.2014 < To contact immediately by phone (10 Symantec clients) Certificates expiring before 01.11.2015 < To contact asap by phone (54 Symantec clients) Certificates expiring before 01.10.2016 < To inform by phone if possible but not urgent. Reminder Mid-2015 (3 Symantec clients) Certificates expiring after 01.10.2016 < Inform whenever possible (0 Symantec client) < Check the Word document to get more details

DON’T FORGET SHA-2! Any client whishing to renew SHOULD renew in SHA-2 if he can. Redirect the client to the KB for more info: https://www.ssl247.co.uk/kb/ssl-certificates/generalinformation/what-is-sha1-sha2 https://www.ssl247.co.uk/kb/ssl-certificates/generalinformation/sha2-compatibility-browsers-os Google plans to “force” the deprecation by displaying warning icons in future versions of Chrome. This will NOT immediately impact the website’s layout, but has to be taken into account by domain owners

What Google is going to do to deprecate SHA-1 in the next versions of Chrome: (Branch point Sept 26 2014) Chrome 40 (Branch point Nov 7 2014) Chrome 41 (Branch point Q1 2015) Certificates expiring Between June 1st and December 31st, 2016 Certificates expiring After Jan 1st, 2017

Any question? marketing@SSL247.co.uk +44 (0)203 69 79 391 +44 (0)203 69 79 391 www.SSL247.co.uk