The SSL Store Names New Vice President of Operations

September 07, 2011 - St. Petersburg, Florida

The SSL Store has promoted Kim Barnard to a position as Vice President of Operations. In the position, Ms. Barnard will head both of The SSL Store’s divisions, retail and channel. Ms. Barnard graduated from Indiana University with a BA in Liberal Arts and previously owned a graphic design and web development studio before joining The SSL Store in 2008.

“This executive position was created for Ms. Barnard because the effort and skill which Kim has brought to our organization over the past three years is remarkable," commented The SSL Store CEO John Tuncer. “Since I’ve started working more closely with her, I’ve realized the impressive extent of her contributions to the company and what she’s capable of moving forward."

As VP of Operations, Ms. Barnard will be managing a business focused primarily on reselling SSL Security Certificates, the standardized technology that allows websites to both encrypt transactions (generating https protocol and the lock symbol in browsers) and display third-party accreditation. Ms. Barnard is currently heading an effort to rebrand The SSL Store with a focus on integrity and credibility. With her as a major player, the company has been growing an average of 11 percent each month. In the coming months, Ms. Barnard will be making numerous sales and customer service hires, in the interest of creating a more sophisticated, relationship-based experience for The SSL Store’s customer base (which is primarily composed of small businesses and web development companies but also includes such notable organizations as NASA, Microsoft, the European Union, and the United Nations).

https://www.thesslstore.com/

About the Author – Kent Roberts is the media contact for The SSL Store. He can be reached directly at (727) 820-1161 or kent [at] thesslstore.com.


Source URL:-https://www.thesslstore.com/pressroom/the-ssl-store-names-new-vice-president-of-operations.aspx

Get Wildcard SSL Certificate @ Discount Price & secure your multiple sub domains with single wildcard SSL

Questions? Call 727-388-4240

Wildcard SSL- thesslstore.com offer Wildcard SSL certificate at best prices ever. Secure your multiple sub domains with single wild card ssl certificate. Wildcard SSL Certificates:- GeoTrust True BusinessID Wildcard If you're looking to secure multiple websites with one server certificate, GeoTrust True BusinessID Wildcard SSL Certificate is the easy, affordable solution. GeoTrust True BusinessID Wildcard SSL Certificate is an ideal solution if you need to secure multiple fully qualified domains that share the same base domain name and reside on the same physical server and share the same second level domain name. Thawte Wildcard SSL Thawte Wildcard SSL is an easy, affordable solution if you need to secure multiple fully qualified domains that share the same base domain name, reside on the same physical server, and share the same second level domain name. RapidSSL Wildcard RapidSSL Wildcard SSL Certificates allows you to secure unlimited number of sub domains. RapidSSL is industry standard 128 / 256 bit single root SSL certificate. RapidSSL certificates have browser recognition of around 99% including IE 5.01+, Netscape 4.7+ and Mozilla 1+ browsers and many other browsers. URL:- https://www.thesslstore.com/wildcardssl-certificates.aspx

Google, Mozilla and Microsoft ban the DigiNotar Certificate Authority in their browsers

 Summary:- Google, Mozilla and Microsoft have banned the DigiNotar Certificate Authority in their browsers.

With the DigiNotar saga continuing, it’s time to summarize some of the current events surrounding it.

According to multiple blog posts, Google, Mozilla and Microsoft have already banned the DigiNotar Certificate Authority in their browsers. This preemptive move comes as a direct response to the mess that DigiNotar created by issuing over 200 rogue certificates for legitimate web sites and services — see a complete list of the affected sites and services.

Earlier this week, Google reported of attempted man-in-the-middle attacks executed against Google users, and most recently, TrendMicro offered insights into a large scale spying operation launched against Iranian web users.

According to TrendMicro:

From analysis of Smart Protection Network data, we see that a significant part of Internet users who loaded the SSL certificate verification URL of Diginotar were from Iran on August 28, 2011. On August 30, 2011 most traffic from Iran disappeared and on September 2, 2011 about all of the Iranian traffic was gone and Diginotar received mostly Dutch Internet users, as expected.

These aggregated statistics from Trend Micro Smart Protection Network clearly indicates that Iranian Internet users were exposed to a large scale man-in-the-middle attack, where SSL encrypted traffic can be decrypted by a third party. For example: a third party probably was able to read all e-mail communication an Iranian Internet user has sent with his Gmail account.

Meanwhile, the Dutch government issued a statement saying that it “cannot guarantee the security of its own websites” and is “taking over the company’s (DigiNotar) operations.”

“the user of government sites no longer has the guarantee … that he is on the site where he wanted to be,” Interior Minister Piet Hein Donner said at a pre-dawn press conference.

Moreover, Illinois-based VASCO, which owns the Dutch-based DigiNotar issued the following statement:

DigiNotar detected an intrusion into its Certificate Authority (CA) infrastructure, which resulted in the fraudulent issuance of public key certificate requests for a number of domains, including Google.com. Once it detected the intrusion, DigiNotar has acted in accordance with all relevant rules and procedures. At that time, an external security audit concluded that all fraudulently issued certificates were revoked. Recently, it was discovered that at least one fraudulent certificate had not been revoked at the time.  After being notified by Dutch government organization Govcert, DigiNotar took immediate action and revoked the fraudulent certificate.

Who’s behind the attacks? According to the Tor Project, clues were found in one of the certificates, including messages in Farsi:

Of particular note is this certificate:CN=*.RamzShekaneBozorg.com,SN=PK000229200006593,OU=Sare Toro Ham Mishkanam,L=Tehran,O=Hameye Ramzaro Mishkanam,C=IR

The text here appears to be be an entry like any other but it is infact a calling card from a Farsi speaker. RamzShekaneBozorg.com is not a valid domain as of this writing.Thanks to an anonymous Farsi speaker, I now understand that the above certificate is actually a comment to anyone who bothers to read between the lines:”RamzShekaneBozorg” is “great cracker“,”Hameyeh Ramzaro Mishkanam” translates to “I will crack all encryption“,”Sare Toro Ham Mishkanam” translates to “i hate/break your head“

VASCO, the owner of DigiNotar said it plans to indefinitely suspend the sale of its traditional and extended-validation (EV) SSL certificates, until the case is solved. “The company will only restart its SSL and EV SSL certificate activities after thorough additional security audits by third-party organizations“.

Source URL:-http://www.zdnet.com/blog/security/google-mozilla-and-microsoft-ban-the-diginotar-certificate-authority-in-their-browsers/9337

SSL for the Rest of Us

Recently, a certificate authority (CA) named Diginotar mistakenly issued valid wildcard SSL certificates for some major websites such as Google, Mozilla, Yahoo, WordPress and the Tor Project. Security experts and application vendors considered this a serious threat to the essential web of trust that the Internet rests upon, and have moved to invalidate Diginotar-issued certificates in their software products.

Many of our clients operate e-commerce applications, and for them, purchasing an SSL certificate is an essential part of doing business online. However, it seems to me that some clients and readers may not fully understand what an SSL Certificate is or why they’re needed. This blog post will hopefully help to explain that.

What is SSL?

The Secure Sockets Layer (SSL) and its successor Transport Layer Security (TLS) are protocols that allow two parties to communicate over a network without any other parties listening to or tampering with that conversation. These protocols are part of a much larger field of computer science known as cryptography.

Let’s say that Bob is doing some online shopping at Alice’s e-commerce store, mirrorsbyalice.com, and finds a product he wants to purchase. Bob needs to send Alice his credit card information privately so that nobody but Alice gets it. Alice, being quite tech savvy, knows that there are two primary ways this can be done:

• Symmetric (conventional) cryptography in which Bob and Alice share a secret key that can be used to encrypt or decrypt the credit card data.
  
  
• Public key (asymmetric) cryptography in which there are two keys, one public and one private. The public key can be used to encrypt the data and only the private key can be used to decrypt it.

Conventional cryptography suffers from a major problem in this scenario. How do Bob and Alice exchange the secret key securely? Well this is the same problem they were trying to solve in the first place with the credit card data! Alice reasons that the only viable method to use for e-commerce is public key cryptography. So Alice generates a private/public key pair and sends Bob the public key so he can use it to encrypt his credit card data.

But wait! Bob is no dunce. How does he know that the public key he receives was sent by the real Alice? This is where certificates come into play.

SSL Certificates

An SSL certificate associates a public key with some sort of identifying information for the party (Subject) that sent it. Certificates are issued and signed by a Certificate Authority (CA). Technically, anybody can issue and sign a certificate. Alice could even act as her own CA and generate something called a self-signed certificate. Although self-signed certificates accomplish the goal of ensuring that the conversation between Bob and Alice is encrypted, Bob still has no way of ensuring that he’s talking to The Real Alice™, and therefore they are not good to use in e-commerce transactions. If Alice wants to assure her shoppers that the certificate really came from her, then she needs to purchase one from a trusted third-party CA.

Certificate Authorities and Certificate Chains

The Internet is built on a web of trust. Each certificate requires the issuer to verify and assure the identity of the certificate subject. As mentioned, this is usually done by a trusted third-party CA. However, the question naturally arises, who verifies and assures the identity of the issuer (CA)? The answer is that there is no one central authority. A number of companies over the course of time have established themselves as Root-Level Certificate Authorities. These companies, such as Thawte andVeriSign, have self-signed certificates and most applications and operating systems are pre-configured to trust them. CAs can also sign each others certificates, effectively delegating authority to another CA. The hierarchy of certificates leading back to a Root-Level CA is known as a Certificate Chain.

Hopefully now you can appreciate the gravity and consequences of the story that opened this post. If one of those trusted CAs gets compromised and issues a valid certificate for a well-known organization, then anyone who has one of those certificates can pretend to be that organization and intercept private communications.

Certificate Types and Certificate Signing Requests (CSR)

Alice realizes that she needs to get a certificate issued by a trusted CA in order for Bob to feel secure in sending her his credit card information. After some research, she realizes she needs to make a few decisions first. Specifically, she needs to decide what kind of SSL certificate to get, and how she wants to be identified in that certificate.

Although CAs come up with all kinds of names for their SSL offerings, they generally fall into different categories based on the level of identity verification or the number of domains (Common Names) they certify:

By Validation	Description
Domain Validated (DV) SSL	The CA checks only that the applicant owns the domain in question.
Organizationally Validated (OV) SSL	The CA verifies that the applicant is a legitimate business by examining business credentials and physical address.
Extended Validation SSL	The CA performs an extensive verification and background check on the applicant. Turns the address bar in browsers green.
By Common Name	Description
Standard	This is the standard, good for one domain name.
Wildcard	Valid for *.example.com. Which includes any subdomain (www.example.com, mail.example.com) but NOT the parent domain (example.com)
UCC/Multi-domain	Allows for multiple names in a single certificate (www.example.com and example.com and someotherdomain.com)

Alice decides to purchase a standard, domain-validated certificate for www.mirrorsbyalice.com. She first generates her private/public key pair on the server that hosts her website. While keeping the private key secret, she then generates a special message called a Certificate Signing Request (CSR) which contains information identifying her business and the public key she just created. She sends the CSR along with any other proofs of identity required to the Certificate Authority. If approved, the CA will send back a certificate that has been digitally signed with the private key of the CA.

Bob’s Browser

With certificate in hand, Alice installs it on her web server and configures her e-commerce application to use it for checkouts. Bob can now click on the checkout button on the website. His web browser will change the communication protocol from HTTP to HTTPS, indicating that it is now communicating with Alice’s website over the Secure Sockets Layer. Since Alice is using a certificate issued by a CA that Bob’s browser trusts, the location bar in his web browser changes to Blue and a little lock appears. Bob now feels much safer about sending his credit card and other personal information to Alice.

Conclusion

SSL/TLS protocols can be used any time a message needs to be sent privately over a network, not just for web browsing. The same technology is used by email servers, FTP servers, and several other internetworking services. As you can see, trust is an integral part of the operation of the Internet, and breaches and misuses of that trust can have far reaching implications. With regard to the Diginotar incident mentioned at the top, many major software vendors have removed this CA from their list of trusted authorities. As an end user, if you see a security update for your browser come through anytime soon, make sure you act on it.

Source URL:-http://blog.nexcess.net/2011/09/02/ssl-for-the-rest-of-us/

SSL CERTIFICATE ISSUE EXPOSES BUG IN MAC OS X

A bug in the Mac OS X Keychain software was exposed when a recently a Dutch certificate issuing authority has issued a fraudulant SSL certificate for *.google.com. This was caused by a hack of the DigiNotar system and 200 certificates were issued. DigiNotar is one of the largest certificate issuing authorities, it is trusted by a large number of browsers and operating systems.

 

Many vendors have issued fixes for the root certificate and most users are secure against it. Mozilla has issued an update on how to manually remove the certificate, Microsoft has also issued a notice and list of affected operating systems on its security advisory board. However, a bug seems to have surfaced on the Mac OS X. Its Keychain software does not seem to recognize that the DigiNotar certificate has been manually removed.

 

As it turns out, this is because of the EV-SSL (Extended Validation SSL) certificate, Keychain ignores the fact that the certificate has been marked as Untrusted by the user. Keychain should ideally override the EV-SSL with the users preferences but that’s not happening so far.

 

Here’s how to manually disable the certificate in Keychain as there is no official fix for it so far.

 

1.       Open the Keychain Access app (found in /Applications/Utilities or just search for it using the Spotlight menu in the top-right corner of your screen)

2.       Click on System Roots and then Certificates on the left side of the Keychain Access window. In the search bar in the top-right corner of the window, type “diginotar” (without quotation marks)

3.       Double-click on DigiNotar Root CA, click on the triangle next to Trust to expand that section, and then next to “When using this certificate:” select “Never Trust”

 Source URL:-http://omar.t3-interactive.com/2011/09/02/ssl-certificate-issue-exposes-bug-in-mac-os-x/

Thawte Builds Online Consumer Trust with New Standard for Extended Validation SSL Certificates

Many online consumers are very wary of website safety. They even refuse to make an e-commerce purchase.

For example, Gartner (News - Alert) reported that in 2006, 46 percent of online adults changed purchasing and online behavior because of security concerns, and 10 percent reduced their online spending by at least half. 

 

That led to almost $2 billion in e-commerce sales being lost. That’s clearly bad for web-based businesses.

 

To help remedy the situation, Web browser developers and SSL Certification Authorities (CAs) (including thawte) came up with a new standard for web site identity authentication.

 

It is called the Extended Validation (EV) SSL Certificate.

 

“This new standard is the most significant advancement for the World Wide Web’s secure backbone since SSL  Certificates were first introduced over a decade ago,” according to awhite paper on the subject from thawte, called, “Extended Validation SSL Certificates: A New Standard to Inspire Trust.”

 

The Extended Validation SSL standard helps remedy low SSL protection visibility and low assurance of a site’s identity, the white paper said.

 

EV features several user interface enhancements so consumers can identify an authenticated site immediately. One such feature is the green address bar. The address bar turns green when an EV-enabled client visits an EV authenticated site. In addition, a security status bar appears to the right of the address bar. The field shows the name of the organization responsible for the web site. If the EV Certificate is altered, an embedded hash will disable the certificate. The validity of every EV Certificate, too, is checked via the OCSP infrastructure and the Microsoft (News - Alert) Root Store.

 

Because Internet Explorer 7 clients on Windows XP may need prompting to update a local root store before getting the new EV interface benefits, thawte offers all EV SSL customers an EV Upgrader. The upgrader prompts an automatic update for IE7 on Windows XP clients. It triggers a normal Windows XP function and should be invisible to the end user. After clients visit a site with EV Upgrader from thawte, the EV interface conventions will be displayed whenever they visit a website protected by an EV SSL Certificate from thawte. 

 

thawte’s EV Certificate provides 256-, 128-, 56- or 40-bit encryption.

 

Want to learn more about the latest in communications and technology? Then be sure to attend ITEXPO West 2011, taking place Sept. 13-15, 2011, in Austin, Texas. ITEXPO (News -Alert) offers an educational program to help corporate decision makers select the right IP-based voice, video, fax and unified communications solutions to improve their operations. It's also where service providers learn how to profitably roll out the services their subscribers are clamoring for – and where resellers can learn about new growth opportunities.

 

To register,click here

 

Follow US On Twitter Here:- @johnasthlon

 

Source URL:-http://it.tmcnet.com/topics/it/articles/213927-thawte-builds-online-consumer-trust-with-new-standard.htm

Google Wildcard SSL Certificate Stolen and Publicly Posted

Hackers have gained access to and made publicly available a digital SSL Certificate for any Google website.

This means that anyone with this certificate could perform a "man-in-the-middle" attack to target Gmail users, Google Plus users, or any other users using Google's online services.

If a hacker is going to steal a certificate, this is definitely the one to get since its considered a wildcard certificate - good for any .Google.com domain. All a hacker has to do is present a fake web site which looks like Google, by poising of DNS or other means, and then present the stolen certificate. Because the certificate is legitimate for any Google.com domain the users would have no warning at all that anything is amiss. Then the attacker could easily steal your login credentials gaining access to all of your Google services.

This specific certificate stolen was issued by DigiNotar, a Dutch-based certificate authority (CA). It's not known if DigiNotar was hacked or if the certificate was stolen by other means.

"The certificate authority system was created decades ago in an era when the biggest on-line security concern was thought to be protecting users from having their credit card numbers intercepted by petty criminals," said the Electronic Frontier Foundation a digital rights group based in the United States. "Today internet users rely on this system to protect their privacy against nation-states. We doubt it can bear this burden."

There has already been reports of Iranian web users being attacked by using the stolen certificate but Google Chrome was already updated to thwart the attack. Google has also already revoked the certificate so that it no longer works.

Google spoke in a statement yesterday that they were "pleased that the security measures in Chrome protected the user and brought this attack to the public's attention. While we investigate, we plan to block any sites whose certificates were signed by DigiNotar." 

Source Url:-http://techtribune.com/news/397/Tech/Google_Wildcard_SSL_Certificate_Stolen_and_Publicly_Posted.html