Telefonica TECH – Everything You Need to Know About SSL/TLS Certificates

April 12, 2021

CISO2CISO post categories: Cyber Security

Rate this post

ElevenPaths 23 March, 2021

Everything You Need to Know About SSL/TSL Certificates

What is a digital certificate?

Secure Sockets Layer/Transport Layer Security digital certificate is the most widely used security protocol that enables encrypted data transfer between a web server and a browser.

Its main function is to ensure confidential data such as passwords, usernames, credit card numbers, email addresses, etc. are used securely on a website by encrypting sensitive data on the one hand and certifying the authenticity of the website we are accessing on the other.

Certificate Authorities (CA) are in charge of validating, issuing and revoking certificates in the same way that a government issues official documents such as ID cards or passports. Certificate Authorities must follow very strict rules and policies when deciding who can or cannot receive a certificate and therefore, having a certificate issued by a CA is an indispensable step to ensure the trustworthiness of the website.

A digital certificate will therefore fulfil two basic functions for establishing a secure connection:

Authenticate and verify the website
Encrypt the information exchanged

Why is it important to have a certificate?

Any website where transactions are carried out or any personal data is requested from the user needs to have an SSL certificate. Whether you sell online or collect data, you need a certificate to ensure that your company and customer data is safe and secure.

The website is one of the most important digital assets for companies as it acts as a constant showcase and must provide security and confidence to your customers.

Here are some examples of the type of information that requires an active digital certificate:

Login and password usage information
Financial information (credit cards, bank accounts)
Personal data (names, addresses, VAT number, dates of birth…)
Legal documents and contracts
Customer lists
Medical history

In addition to protecting the information on your website, having a digital SSL certificate:

It will avoid failures in the most used browsers such as Chrome and Firefox by avoiding displaying the “not secure” message.
Improve your SEO positioning by being detected by Google.
You will have insurance coverage and quality seals.
You will be protected against attacks such as man in the middle.
Encrypt information end to end.
It will provide trust to your users and will be visible in the browser as shown in this example:

Types of Certificates

Before issuing a certificate, the Certification Authority (CA) must confirm that the entity or person requesting it is real and authorised to request the certificate. Elements such as the type of trust they grant, the needs and uses of the certificates have led to the emergence of different types of SSL certificates. We talk about them below:

Certificates according to the type of validation

Certificates with Domain Validation (DV): these are the most basic level certificates as they use the simplest validation. It validates that the applicant is really the owner of the domain in which the certificate will be installed. This is normally done by email and after performing some checks through the DNS records of the domain. Therefore, the level of trust provided by this kind of certificates is low because any applicant who is the owner of a domain can get the SSL certificate and change the “http” of his website for an “https”.
Certificates with Organisation Validation (OV): these are certificates in which the verification process increases with respect to the previous ones, as a verification must be carried out at company or organisation level. In this case, this is done through a manual process in which a person verifies the domain and the company through information on the entity, tax headquarters and a series of official data to ensure the authenticity of the application. This is one of the most commonly used certificates by SMEs and medium-sized companies because, once the verification process has been completed, all the company’s information will be shown in the certificate details, thus providing extra trust to users who visit the website. It is usually used to certify corporate websites or tools used by the company’s clients.
Certificates with Extended Validation (EV): these certificates already represent the highest level of security and trust. Their verification is much stricter and includes, in addition to the legal verification of company data and official documentation, the physical inspection of the company. With these certificates the company name will appear in green in the browser bar in front of the web address. Large corporations often apply for such certificates and the approval process usually takes several weeks because the validation mechanisms are much more rigorous.

Certificates According to Domains or Subdomains

Wildcard certificates: wildcard certificates are necessary when the website uses several subdomains under a main domain so that this type of certificate can protect the main domain and all the associated subdomains. For example, within the main domain telefonica.com we can have the following subdomains: tech.telefonica.com ; pymes.telefonica.com or empresas.telefonica.com. Companies that, due to their type of business, need to associate tools to subdomains or simply need to have several protected subdomains to cover their offer. Depending on the number of subdomains that need to be protected, the choice of a wildcard could be the most economical option and its use is only recommended for environments where the technical platform may require it, such as some proxies, balancers, etc.
Multi-domain certificates: multi-domain certificates known as certificates with SAN (Subject Alternative Name) option are the best choice if it is necessary to protect several domains and subdomains under the same certificate. One of the main advantages of this type of certificate is that it simplifies the server configuration process by allowing several services to be run under the same IP address, and it also makes changing, adding or deleting any SAN certificate easier. They are often used to secure Microsoft Exchange Server, Office Communications Server, Mobile Device Manager or, as we mentioned, to secure multiple domains that meet a single IP address.
Certificates from Let’s Encrypt: Let’s Encrypt is an automated and open CA that allows you to get a free SSL certificate for your domain. The main advantage, apart from being free, is that it is installed immediately and automatically. It is a valid solution depending on the type of certificate you need, but is there any risk in using this type of certificate? In this article we detail some of the security problems that have affected Let’s Encrypt (Spanish only ).

How Often Do They Expire and How Can I Check Their Expiry Date?

Officially, the maximum lifetime of certificates is currently 397 days (13 months) and it is therefore important to set automatic reminders for renewal.

There is management software that sends automatic reminders when an SSL/TLS certificate is about to expire, so there is no excuse for forgetting about it.

These are some of the tools available to check the expiry date of a certificate:

To Manually Check When an SSL Certificate Expires

Access the website whose certificate you want to verify through your browser
Click on the padlock next to https:// in the browser bar as shown in the image below
In the certificate section you can check the expiry date

Common TLS/SSL server failures

Although the TLS/SSL security layer has become widespread as an essential service in organisations such as web servers, file sharing, etc., and its main function is to strengthen security, it must be audited to ensure that its purpose is properly fulfilled.

In this article (Spanish only), we briefly explain some of the common failures in SSL/TLS servers and X509 certificates, because it is the combination of both entities and their correct configuration that can ensure a reliable and secure connection.

Where is the TSL heading?

These are challenging times for cryptography. Although the ordinary user may not realise it, the world of encrypted and authenticated (but not secure) websites is undergoing a profound overhaul of everything that has been established. Something as immutable in principle as cryptography is going through a strange moment in which we do not know how it will end. What is certain, however, is that we must change our classical beliefs about how the web works.

As it already happened with Symantec in 2017 when Google questioned the reliability of its certificates, or the case of FMNT for Firefox to include its certificate in its repository (Spanish only ), which took several years, in 2021 it is the turn of Carmerfirma, a CA that has been affected by the new update of Google’s security policies coinciding with the release of Chrome 90.

In the following articles we will review some recent developments that have turned the world of digital certificates upside down:https://business.blogthinkbig.com/26-reasons-chrome-does-not-trust-spanish-ca-camerfirma/embed/#?secret=lYNz4q8qWXhttps://business.blogthinkbig.com/more-shorter-certificates-lower-lifetime-where-is-tls-going/embed/#?secret=4llHQ3yq5Fhttps://business.blogthinkbig.com/internet-cybersecurity-tls-certificates/embed/#?secret=VvWDOCX9I5

What is Certificate Transparency?

Certificate Transparency is a mechanism devised and supported by Google for SSL certificate monitoring that aims to combat a long-standing problem in the web world: fake certificates or certificates issued in the name of someone else. In this way, domain owners can use this framework to monitor the issuance of certificates for their domains and detect erroneously issued certificates.

Certificate Transparency became known around 2014, when Google announced that it would be a mandatory requirement for Extended Validation (EV) SSL/TLS certificates issued from January 2015 onwards. Since then, these requirements have been extended over the years so if you want to know more about Google’s Certificate Transparency you can read more about the what, how and why of Certificate Transparency in this article.

What is a PKI?

A Public Key Infrastructure is the body and place where a certificate is issued (among other actions). It provides the necessary trust to ensure the identity of the certificate holder.

A PKI requires

Technology: sufficiently proven and reliable security technology must be used.
Qualified operators: the personnel operating the PKI must be qualified and trustworthy.
Qualified administrators: administrators must have security skills.
Secured facilities: facilities must have additional security measures, both physical and logical. For example: volumetric control or dual access.
Policies: requires the existence of legal documents covering the entire lifecycle.
Procedures: both IT-specific and security-specific procedures must be in place.
Integration: requires to be recognised by other organisations and applications. For example by browsers