eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
At the heart of much of the Internet’s security is the use of Secure Sockets Layer/Transport Layer Security (SSL/TLS), which provides encryption for data in motion. Certificate Authorities (CAs) are the trusted entities that issue TLS certificates, and as a group, the CAs are gearing up for big year in 2016, with multiple efforts designed to improve the security of the Internet.
Among the leading associations of CAs is the CA Security Council (CASC), a group of organizations that got started in 2013 as an advocacy building group for the SSL/TLS industry.
The big change that the CASC is helping to usher in on Jan. 1, 2016, is the widespread deployment of TLS certificates signed with the SHA-2 (Secure Hash Algorithm) cryptographic hash. SHA-2 is the successor to SHA-1, which has been widely deployed in the last decade and is now seen as cryptographically insecure.
“Any Website that needs to get a TLS certificate will only be able to get a SHA-2 certificate as of Jan. 1,” Bruce Morton, director of certificate services at Entrust, told eWEEK. “All the modern operating systems and browsers support SHA-2, but a small percentage of older browsers don’t support SHA-2.”
While some systems and devices don’t support SHA-2, the shift on Jan. 1 will not break the Internet or actually change the way the Web works.
“On Jan. 1, nothing really happens that’s different than Dec. 31,” Doug Beattie, vice president of product management at GlobalSign, told eWEEK. “Everyone has been working hard at replacing their SHA-1 certificates with SHA-2, and that will continue because no one will be able to issue a SHA-1 certificate anymore.”
Beattie added that the browser vendors aren’t making instant updates on Jan. 1 that disable SHA-1. That said, browser vendors have announced plans to slowly deprecate support for SHA-1, but that’s a gradual process and from a user perspective; the Internet will work the same on Jan. 1 as it does on Dec. 31.
“Some organizations, however, might be surprised when they go to renew their TLS certificate in the first or second quarter of 2016 and realize they can’t get a SHA-1 certificate,” Beattie said.
Both Beattie and Morton emphasized that the CAs have been contacting customers over the course of 2015 with reminders about the SHA-1 deadline and the need to migrate to SHA-2. Approximately 80 percent of Websites are already supporting SHA-2, Morton said.
Even for users on older devices and operating systems that do not support SHA-2 by default, there typically is an easy workaround—just install a new browser that supports SHA-2, Morton said. For example, while Windows XP SP2 doesn’t support SHA-2, Firefox can still be installed on that operating system and will provide SHA-2 support, he added.
RC4
SHA-1 isn’t the only issue that will impact CAs and Web server operators in 2016. The RC4 stream cipher, which is also used in TLS encryption, is also being deprecated across the Internet, as it has been deemed to be cryptographically insecure, as well.
In contrast to the SHA-1 issue, which requires Websites to obtain a new SHA-2 certificate from a CA, with RC4, no new certificate is required.
“RC4 is more of a server-configuration issue,” Morton explained. “Organizations need to make sure they are selecting the right set of cipher suites to support secure TLS.
CA Council to Improve Internet Certificate Security in 2016
Certificate Validity
Another issue that CAs will be dealing with in 2016 is the length of time for which a given TLS certificate is valid. In 2015, a new policy came into effect that reduced the maximum validity of a TLS certificate to 39 months, down from a 60 months.
“We’ve gone from a place in the last few years where there was no limit, and then in 2012, we capped it at 60 months,” Beattie said. “When the 60-month cap was announced, we also announced the plan to bring it down to 39 months for 2015.”
There hasn’t been any pushback from customers on the certificate term length, as most enterprise customers tend to be looking for certificates that are valid for one to three years, Beattie said.
A trend that started to emerge in 2015, according to Morton, is that some customers wanting short-lived certificates of only two weeks.
“People are getting concerned about key compromise, so it’s good cryptographic hygiene to keep rolling keys with new certificates,” Morton said.
Overall, Beattie sees 2016 as a year of opportunities for the CAs, rather than just being a year where outstanding challenges are addressed.
“There are more opportunities now for customers to protect things and make choices about security,” Beattie said. “In past years, the push has been about moving from 1,024-bit to 2,048-bit encryption and from SHA-1 to SHA-2, so hopefully, 2016 will be less about challenges and more about opportunities for organizations to secure their sites in different ways.”
Sean Michael Kerner is a senior editor at eWEEK and InternetNews.com. Follow him on Twitter @TechJournalist.