Ad Clicks : Ad Views : Ad Clicks : Ad Views : Ad Clicks : Ad Views : Ad Clicks : Ad Views :
The Tech Art

The Tech Art – Download App for PC, Gaming News, Mobiles, Reviews, How to Guides, Technology News, Downloads, Tips & Tricks

Home / News / Tech News – Google Chrome helps clean up certificate authority industry

Tech News – Google Chrome helps clean up certificate authority industry


Bringing you the latest news from across the tech world. Now go ahead and read what you were looking for, but remember keep checking our news section for more of the latest technology news to keep you up to date and in the know.

Google Chrome helps clean up certificate authority industry

Google Chrome has imposed requirements that all certificate authorities (CAs) log every digital certificate they issue in certificate transparency logs.

The public logs list all certificate information so it can be inspected, and coupled with rules which restrict which CAs can issue for which domains, industry commentators believe the move represents a significant step forward in improving internet security.

Any website with a secure sockets layer (SSL) or transport layer security  (TLS) certificate that is not logged will trigger a browser warning that tells users the website’s certificate is not compliant with Google Chrome’s transparency policy and might not be safe.

Any elements of a website served over https connections that are not compliant will fail to load and will show an error in Chrome DevTools.

The aim is to improve certificate transparency to better protect both users and companies from becoming victims of certificate misuse.

Cyber criminals have increasingly targeted internet users by finding ways to issue their own certificates. The move is also aimed at improving the processes for identifying and revoking illegitimate certificates.

Google Chrome is reportedly in use by 60% of the market and is using its market dominance to drive better practices, with most other major browsers expected to follow its example.

Broderick Perelli-Harris, senior director for professional services at Venafi, said the move from Google is welcome as another step towards enforcing best practice for the CA industry.

“From Trustico to GlobalSign, there have been plenty of recent cases of CA errors that impact businesses – and businesses are starting to wake up to the problem, 80% of businesses say they are worried about future CA incidents affecting their operations. Google highlighting cases of mis-issuance will help companies protect themselves and their customers,” he said.

However, Perelli-Harris said the flipside is that companies need both a way to process the intelligence that certificate transparency is providing and a way to respond. “They need to be able to take action to protect themselves.  

“This is why businesses need crypto-agility over security critical SSL/TLS machine identities, including keys and certificates. Given the current threatscape, it is imperative that companies are able to identify, revoke and replace SSL/TLS certificates instantly.

“Unfortunately, at present, very few have this capability. According to Venafi research, only 23% are completely confident in their ability to quickly find and replace all their impacted certificates, and only 8% have actually automated the process,” he said.

“The transparency log will help raise standards for CAs across the board, but it’s impossible to remove errors entirely, and companies have to be able to react quickly when problems occur.”

Source link
Author


  • Facebook
  • Twitter
  • Google+
  • Linkedin
  • Pinterest

Leave a Comment

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

This div height required for enabling the sticky sidebar
%d bloggers like this: