Certificate Authorities Form Group to Educate on SSL Best Practices

The past few years have not been easy for certificate authorities (CAs). CAs issue and validate the digital certificates that form the foundation of trusted transactions online, essentially allowing two parties to prove they are who they say they are.

But in the past several years, CAs like RSA, DigiNotar and Comodo have been the victims of breaches that potentially allowed hackers to create their own fraudulent certificates. Last week, a banking Trojan was found in the wild with a valid digital certificate purchased from a CA using a fraudulent identity.

The problem is not an academic one. Last week, security firm Bit9 disclosed that hackers had penetrated its network, gained access to several of its digital certificates and used them to masquerade as Bit9 to install malware on the systems of three of Bit9’s customers.

Responding to these increasing threats—sophisticated hacker networks, global cybercriminal organizations and state-sponsored espionage—seven global CAs came together on Thursday to form the Certificate Authority Security Council (CASC), an advocacy group aimed promoting best practices to advance the security of websites and online transactions. The CAs include Comodo, DigiCert, Entrust, GlobalSign, Go Daddy, Symantec and Trend Micro. Together they represent 95 percent of all certificates issued, says Kirk Hall, operations director for Trust Services at Trend Micro.

“There have been increased threats against CAs in the past several years,” says Hall. “There was room for us to do more working together as CAs.”

“There’s a surprising amount of things that we can do with users and others involved in deploying certificates that can make the system much stronger,” he adds.

CASC Will Start by Promoting OCSP Stapling

CASC’s first initiative will be a series of educational and advocacy efforts related to best practices in SSL deployment, particularly online certificate status checking and revocation.

“If we look at the SSL ecosystem as it exists today, there’s a few things that could be better,” says Ryan Hurst, CTO of GlobalSign. “SSL isn’t deployed as widely as everyone would like. And even people that deploy SSL only deploy it on a portion of their sites because they’re concerned about performance.”

For that reason, the first initiative will highlight the benefits of Online Certificate Status Protocol (OCSP) stapling to web server administrators, software vendors, browser developers and end users. OCSP stapling is an alternative approach to OCSP, which is used to check the revocation status of X.509 certificates. OCSP is often seen as the culprit behind the performance hits that Hurst says prevents people from deploying SSL more broadly.

“OCSP stapling actually goes a long way toward reducing the performance tax associated with performing that check and thus speeds up SSL,” Hurst says.

Hurst notes that advocating best practices around code signing is likely to be a future initiative of CASC.

“This is just the first of many projects that we as a group will work on together,” Hurst says.

Thor Olavsrud covers IT Security, Big Data, Open Source, Microsoft Tools and Servers for CIO.com. Follow Thor on Twitter @ThorOlavsrud. Follow everything from CIO.com on Twitter @CIOonline, Facebook, Google + and LinkedIn. Email Thor at tolavsrud@cio.com