Tag Archives: EV SSL

Migration von 1024 Bit auf 2048-Bit-Verschlüsselung – Was Sie wissen müssen

Das Certificate Authority/Browser Forum hat alle Zertifizierungsstellen aufgefordert, die Unterstützung für RSA-Zertifikate mit 1024-Bit-Schlüsseln bis zum Ende dieses Jahres (2013) einzustellen. Hiervon sind sowohl SSL- als auch Code-Si…

Tout ce que vous devez savoir sur la transition du cryptage à 1024 bits au cryptage à 2048 bits

Vous n’êtes certainement pas sans savoir que le Certificate Authority/Browser Forum a enjoint les autorités de certification (AC) de cesser toute prise en charge des certificats RSA de 1 024 bits, tant pour la protection SSL que pour la signature de code, d’ici la fin de l’année 2013. Pour en savoir plus, je vous invite à lire l’article du CA/Browser Forum intitulé Baseline Requirements for the Issuance and Management of Publicly-Trusted Certificates, dans lequel l’organisme présente ses exigences de base pour l’émission et la gestion de certificats.

Comment procéder ?

Les clients Symantec dont les certificats arrivent à expiration d’ici la fin de l’année 2013 devront générer une requête de signature de certificat (CSR) de 2 048 bits ou plus lors de leur renouvellement. Les clients Symantec possédant des certificats expirant en 2014 devront remplacer l’ensemble de leurs certificats de 1 024 bits par des certificats RSA/DSA de 2 048 bits ou ECC de 256 bits, ce avant le 1er octobre 2013. Plus aucun certificat de 1 024 bits ne sera pris en charge à partir de 2014. Cette décision s’inscrit dans le cadre de la publication spéciale 800-131A du NIST. Pour en savoir plus, cliquez ici.

Je vous recommande également de consulter ces quelques ressources utiles pour vous accompagner dans cette transition.

Vérifiez la puissance de cryptage de vos certificats

Comment générer une nouvelle CSR

Nous proposons plusieurs tutoriels consacrés à la génération d’une CSR :

Vous pouvez vérifier et valider votre CSR à l’aide de cet outil.

Comment installer un certificat

Nous proposons plusieurs tutoriels consacrés à l’installation d’un certificat SSL :

 

Si vous êtes équipé d’un serveur Microsoft IIS 6.0 ou 7.0 avec une version .NET 2.0 ou ultérieure, ou encore d’un serveur Red Hat, l’outil « SSL Assistant » vous aide à générer automatiquement votre nouvelle CSR de 2 048 bits, puis à installer votre certificat.

Ressources complémentaires :

FAQ : fin de la prise en charge des certificats de 1 024 bits (Anglais)

Support : transition des certificats de 1 024 bits vers des certificats à plus fort cryptage

Todo lo que necesita saber para migrar del cifrado de 1024 bits al cifrado de 2048 bits

A estas alturas, seguramente ya sepa que el Certificate Authority/Browser Forum ha ordenado a las autoridades de certificación que dejen de admitir certificados RSA con claves de 1024 bits para SSL y firma de código de aqu&…

A solid foundation for public sector security.

The public sector has a somewhat mixed record when it comes to staving off security breaches within its walls. In the UK, for example, the hugely embarrassing data losses at HMRC (Inland Revenue/Taxation services) – when the personal details of 25 million people were heavily compromised, due to what were described as “serious institutional deficiencies” – still linger in the mind a few years down the line.

On the plus side, the UK government has been heavily engaged in getting its own house in order, identifying information security as a key priority for 2013 and beyond. In recent months, new initiatives to address growing cyber security threats have been announced, with a cyber security ‘fusion cell’ established for cross-sector threat information sharing. The intention is to put government, industry and information security analysts side-by-side for the first time. The analysts will be joined by members of intelligence agencies, law enforcement and government IT, as they exchange information and techniques, and monitor cyber attacks in real time.

However, many of today’s businesses work across international boundaries, so preventing breaches and loss of data has become a world-wide challenge. According to a report from Ernst & Young, ‘Data loss prevention: Keeping your sensitive data out of the public domain’, companies in every industry sector around the globe have seen their sensitive internal data lost, stolen or leaked to the outside world.

“A wide range of high-profile data loss incidents have cost organisations millions of dollars in direct and indirect costs, and have resulted in tremendous damage to brands and reputations,” it states. “Many different types of incidents have occurred, including the sale of customer account details to external parties and the loss of many laptops, USB sticks, backup tapes and mobile devices, to name just a few. The vast majority of these incidents resulted from the actions of internal users and trusted third parties, and most have been unintentional.

“As data is likely one of your organisation’s most valuable assets, protecting it and keeping it out of the public domain is of paramount importance. In order to accomplish this, a number of DLP [Data Loss Prevention] controls must be implemented, combining strategic, operational and tactical measures.”

In the face of such global threats, governments are responding. The European Commission, for example, has introduced a computer emergency response team in each member country to promote reporting of online attacks and breaches. The recently published draft EU Cybersecurity Directive makes it compulsory for all ‘market operators’, including utilities, transport and financial services businesses, as well as public authorities who use ‘network and information systems’ within their businesses, to implement technical and organisational measures to manage cyber risks.

These organisations will be subject to independent regulation, have to disclose security breaches to the regulators, submit to compulsory regulatory audits and be sanctioned, if they fail to comply with the law.

All good news, then… But the simple reality is that any public sector department or body intent on ensuring its own security could readily put in place measures to stop such data breaches and losses, such as, for example, secure File Transfer Protocols and Data Guardians (a secure database application with up to 448-bits of Blowfish encryption), enabling the locking down of data.

Public sector organisations are often, by their nature, large and complex, making it relatively easy for a rogue employee to access a sub-set of highly sensitive data; or simply to move on to another job, with the organisation unaware that a certificate relating to that employee is about to expire, all due to a lack of adequate central management. So they need such solutions.

Take Symantec’s Managed PKI for SSL service, for example, which enables organisations to manage and deploy SSL certificates from a single centrally managed platform, while also tailoring the deployment to meet their individual requirements (such as, if your organisation needs to issue multiple SSL certificates to different internal organisations or business units. Managed PKI for SSL allows for both centralised control and delegated administration). This cloud-based approach dramatically lowers the cost and complexity of managing multiple SSL certificates by eliminating the time it takes to authenticate multiple different business units, individual purchasing, personnel, training, and maintenance expenses and complexity associated with deploying multiple SSL certificates.

What SSL does is to protect applications that demand the highest level of security – enabling the secure transmission of sensitive data, Web services-based business process automation, digital form signing, enterprise instant messaging and electronic commerce. It also protects firewalls, virtual private networks (VPNs), directories and enterprise applications. Trust lies in knowing that the people, networks and devices accessing, modifying or sharing information within a community are verified.

There can be a tendency to imagine things are worse in our own backyard, but the security issues we face in the UK are, by and large, no different from those in other countries or indeed in other industries. One manufacturer in Europe, for instance, saw its production line go down when a certificate suddenly expired. Eventually, the problem was traced to an expired SSL certificate. Symantec’s solution, through a complete audit of the company’s architecture, using a product called Certificate Intelligence Center, would have identified any certificates that were about to expire and immediately notified the business – and (if a Symantec SSL certificate) automatically have renewed the offending certificate. Instead, the outcome was estimated to be in the millions of Euros, in terms of lost production, damage to their brand, corporate reputation and a workforce standing idle.

What you need to know to migrate from 1024-bit to 2048-bit encryption

I hope by now that you are aware that the Certificate Authority/Browser Forum has mandated that Certificate Authorities stop supporting 1024-bit key length RSA certificates for both SSL and code signing by the end of this year (2013). To learn more abo…