1. Deprecation of certificates for internal needs
21/02/2019
Deprecation of certificates for internal needs

2. Reserved IP address range
WHY?
Not directly linked to the launch of new domain names extensions! The decision was made in June 2012 by CA/B forum
Main reason: security issue
Short version => Local domains are not unique, unlike public domains or public IPs, so they cannot be vetted by CAs
+ the launch of new gTLDs can create collisions between a local domain and a public domain
WHAT IS PUBLIC, WHAT IS PRIVATE?
<<< Public domain name (aka FQDN)
Reserved IP address range
<<< Private domain name (aka local domain)
<<< Public IP address
<<< Private IP address (aka reserved / local IP)
prod-cft-1
<<< Machine name (always private)
/!\ There are exceptions. Any doubt, consult this page:

3. Nameserver’s cache database
Long version => 2 examples
1.Let’s say Barclays has deployed an internal mail system
at the address
Legitimate server
The system is not reachable from the public Internet – only on the local corporate network or over the VPN
The name mail is not unique, so anyone can potentially obtain a certificate that validates for
Employee’s computer
If you bring such a certificate into Barclay’s network, it can be used in combination with local name spoofing* to perfectly impersonate the real corporate mail server and steal users’ credentials and other confidential information.
Hacker’s server
Nameserver’s cache database
*DNS spoofing (or DNS cache poisoning) is a computer hacking attack, whereby data is introduced into a Domain Name System (DNS) name server's cache database, causing the name server to return an incorrect IP address, diverting traffic to another computer (often the attacker's).

4. Employee’s laptop asking to see the page
2.Let’s say Barclays has deployed an internal mail system
at the address
Local server
ICANN decides to launch .corp as a new extension
Employee’s laptop asking to see the page
A hacker registers the domain Barclays.corp, and issues a DV certificate to secure it.
The hacker perfectly impersonates the real corporate mail server and uses DNS cache poisoning attacks to redirect people to the hacker’s server.
The attacker might not even need to be on the corporate network to mount a successful attack. If a user connects their corporate laptop to a public WiFi network, the mail client might automatically attempt to connect to “ or” before a VPN connection is established. If an attacker has anticipated this, again, a perfect impersonation can be made.
Hacker’s server

5. WHAT? All our CAs will respect the deprecation To be deprecated
Local domains
Local IPs
Server names
prod-cft-1
Not deprecated
Public domain names
Public IPs

6. WHEN?

7. BATTLE PLAN MARKETING SIDE
Blog article: being translated into all languages
DotMailer campaign: being translated into all languages
To be sent on Thursday (Sept 11)

8. SALES SIDE: CLIENTS FIRST!
Certificates expiring before < To contact immediately by phone (10 Symantec clients)
Certificates expiring before < To contact asap by phone (54 Symantec clients)
Certificates expiring before < To inform by phone if possible but not urgent. Reminder Mid-2015
(3 Symantec clients)
Certificates expiring after < Inform whenever possible (0 Symantec client)
< Check the Word document to get more details

9. DON’T FORGET SHA-2!
Any client whishing to renew SHOULD renew in SHA-2 if he can.
Redirect the client to the KB for more info:
Google plans to “force” the deprecation by displaying warning icons in future versions of Chrome. This will NOT immediately impact the website’s layout, but has to be taken into account by domain owners

10. What Google is going to do to deprecate SHA-1 in the next versions of Chrome:
(Branch point Sept )
Chrome 40
(Branch point Nov )
Chrome 41
(Branch point Q1 2015)
Certificates expiring
Between June 1st and
December 31st, 2016
Certificates expiring
After Jan 1st, 2017

11. Any question? marketing@SSL247.co.uk +44 (0)203 69 79 391
+44 (0)