SSL stands for Secure Sockets Layer; it is the standard technology for keeping an Internet connection secure and safeguarding any sensitive data sent between two systems. The two systems can be server to client (for example, a shopping website and browser) or server to server (for example, an application with personal identifiable information or payroll information).

Table of Contents

What is a TLS Certificate?

TLS stands for Transport Layer Security, which is just an updated, and more secure, version of SSL. TLS is a cryptographic protocol that establishes an encrypted session between applications over the Internet.

TLS certificates usually contain the following information:

• The subject domain name
• The subject organization
• The name of the issuing CA
• Additional or alternative subject domain names, including subdomains, if any
• Issue date
• Expiry date
• The public key (The private key, however, is kept a secret.)
• The digital signature of the CA

How does TLS work?

TLS uses a combination of symmetric and asymmetric cryptography, as this provides a good negotiation between performance and security when transmitting data securely.

Lean more about TLS handshake:

Certificate Management | Usage | Security | Encryption Glossary (encryptionconsulting.com)

Standard SSL handshake

The communication over SSL always begins with the SSL handshake. The SSL handshake allows the browser to verify the web server, get the public key, and establish a secure connection before the beginning of the actual data transfer.

The following steps are involved in the standard SSL handshake:

1. Client Hello

   Server communicates with the client using SSL.This includes the SSL version number, cipher settings, and session-specific data.

2. Server Hello

   The server responds with a “server hello” message.This includes the server’s SSL version number, cipher settings, session-specific data, an SSL certificate with a public key, and other information that the client needs to communicate with the server over SSL.

3. Authentication

   The client verifies the server’s SSL certificate from the CA (Certificate Authority) and authenticates the server.If the authentication fails, then the client refuses the SSL connection and throws an exception. If the authentication succeeds, then they proceed to the next step.

4. Decryption

   The client creates a session key, encrypts it with the server’s public key and sends it to the server.If the server has requested client authentication (mostly in server to server communication), then the client sends their own certificate to the server.

5. Encryption with Session Key

   The server decrypts the session key with its private key and sends the acknowledgement to the client encrypted with the session key.

Thus, at the end of the SSL handshake, both the client and the server have a valid session key which they will use to encrypt or decrypt the original data.

What are the types of SSL certificates?

There are multiple types of SSL certificates available today based on the validation level and number of domains they secure.SSL Certificates based on Validation Level:

1. Domain Validated certificate

   The Domain Validated (DV) certificate requires the lowest level of validation because, the main purpose of DV certificates is to secure communication between the domain’s web server and browser. The CA only verifies that the owner has a control over the domain.

2. Organization Validated Certificates

   The Organization Validated (OV) certificate requires a medium level validation where the CA checks the rights of an organization to use the domain and the organization’s information. The OV certificate enhances the trust level of the organization and its domain.

3. Extended Validated Certificates

   The Extended Validated (EV) certificate requires a high-level validation where the CA conducts rigorous background checks on the organization according to guidelines. This includes verification of the legal, physical, and operational existence of the entity.

SSL Certificates based on the Number of Domains:

1. Single Domain Certificate

   Single Domain Certificates secure one fully qualified domain name or subdomain name.

2. Wildcard SSL Certificate

   Wildcard certificates cover one domain name and an unlimited number of its subdomains

3. Multi-Domain SSL Certificate

   The Multi-Domain SSL certificate secures multiple domains using the same certificate with the help of the SAN extension. It is especially designed to secure Microsoft Exchange and Office Communication environments.

How will visitors know my site has an SSL certificate?

There are a few visual clues mentioned below to indicate a website has an SSL certificate:

• Padlock to the left of a URL
• An https URL prefix instead of http
• A trust seal
• A green address bar (when an EV SSL certificate is issued)

How does SSL/TLS use both asymmetric and symmetric encryption?

SSL uses symmetric encryption to encrypt data between the browser and web server while asymmetric encryption is used to exchange generated symmetric keys which validate the identity of the client and server.

Difference between SSL and TLS Certificates

The Difference between SSL and TLS certificates are minor, the notable differences include:

For Comparison	SSL	TLS
Abbreviation	SSL stands for “Secure Socket Layer.”	TLS stands for “Transport Layer Security.”
Cipher suites	SSL protocol offers support for Fortezza cipher suite	Cipher suites SSL protocol offers support for Fortezza cipher suite The TLS standardization process makes it much easier to define new cipher suites, such as RC4, Triple DES, AES, IDEA, etc.
Version	Three versions of SSL have been released: SSL 1.0, 2.0, and 3.0	Four versions of TLS have been released: TLS 1.0, 1.1, 1.2, and 1.3
Version Status	All versions of SSL have been found vulnerable, and they all have been deprecated	TLS 1.0 and 1.1 have been “broken” and are deprecated as of March 2020. TLS 1.2 is the most widely deployed protocol version
Secure Communication	SSL is a cryptographic protocol that uses explicit connections to establish secure communication between the web server and client	TLS is also a cryptographic protocol that provides secure communication between the web server and client via implicit connections. It is the successor to the SSL protocol.
Master Secret	SSL creates a master secret, the message digest of the pre-master secret is used	TLS uses a pseudorandom function to generate the master secret

How to check an SSL certificate in Chrome and Firefox?

Any site visitor can follow the below step to get certificate information in Chrome:

• Click the padlock icon in the address bar for the website
• Click on Certificate (Valid) in the pop-up
• Check the Valid from dates to validate the SSL certificate is current

Any site visitor can follow the below step to get certificate information in Firefox:

• Click the padlock icon in the address bar for the website
• To check the details of the certificate, click on more information’

For more details about the certificate, just click “View Certificate”.

How to find your SSL certificate?

There are two methods to locate the installed SSL certificates on a website you own. In Windows Server environment, the installed certificates are stored in Certificate Stores, there are containers which holds one or more certificates. These containers are:

• Personal, which holds certificates associated with private keys to which the user has access.
• Trusted Root Certification Authorities, which includes all the certificates in the Third-Party Root Certification Authorities store, plus root certificates from customer organizations and Microsoft
• Intermediate Certification Authorities, which includes certificates issued to subordinate CAs.

You can check the certificate stores manually on your local machine:

• Step 1: Open Microsoft Management console (mmc)

  Run > type mcc > EnterOrOpen command prompt > type mcc > Enter

• Step 2: Click on File from the menu > select Add/Remove Snap-in

• Step 3: From the Available snap-ins list, choose Certificates, then select Add.

• Step 4: Select Computer account > click Next.

• Step 5: Select Local computer > click Finish.

• Step 6: At the “Add or Remove Snap-ins” window > click OK.

• Step 7: To view your certificates in the MMC snap-in > select a certificates store on the left pane. The available certificates are displayed on the middle pane.

• Step 8: Double click on a certificate, the Certificate window appears which displays the various attributes of the selected certificate.

Certificate Manager Tool

This is another method to view the installed certificates by launching windows Certificate Manager Tool.

• Step 1: On your local machine > open command console > type certlm.msc (Certificate Manager tool for the local device appears)
• Step 2: Under Certificates – Local Computer > expand the directory for the type of certificate you want to view

How to determine if the site you are visiting uses SSL certificates?

Along with checking your own certificate, it is important to be able to determine, if the site you are visiting uses SSL certificates. Below are a few points which you should keep in mind to check if the site uses certificates:

1. Look for is the “https” in the URL of the site you are visiting. The “s” declares that this site is using an SSL Certificate.
2. If you are Using Firefox > click on the padlock in the address bar > in the dropdown it should show secure connection, the secure connection indicates properly configured SSL is in use.

How to check if an SSL certificate is valid ?

SSL Certificates validity period is generally set to expire anywhere between one to three years. The validity period of the certificate completely depends on the company policy, cost considerations etc.There are multiple tools available to check the SSL certificates validity, in this article we will see how you can check the certificate validity by yourself.

• Option 1: This process is time-consuming

  Run > certlm.msc > open Certificates Local Computer

  Go through the list of the certificates listed in the store to make sure only the legitimated ones are installed.

• Option 2: Download the Windows sysinternals utility

  Use Windows Sysinternals utility called sigcheck > Download

  Once it is downloaded and installed > run command sigcheck -tv

  Sigcheck downloads the trusted Microsoft root certificate list and provide outputs for only valid certificates.

How to set SSL certificates in Linux?

Install an SSL certificate on Linux (Apache) servers: 

1. Using S/FTP upload the certificate and the key files.
2. Login to the server via SSH (as a root user).
3. Enter Root password
4. Move the certificate file and key file to /etc/httpd/conf/ssl.crt.

   4.1. [It is important to keep the files secure by restricting permission. Using ‘chmod 0400’, you will securely restrict permission to the key]

5. To edit Virtual Host Configuration setup for the domain, go to etc/httpd/conf.d/ssl.conf..
6. Restart Apache
7. Test the SSL Certificate using different browsers.
8. Visit the site with the secure https URL to verify the SSL certificate is working correctly. Example: www.encryptionconsulting.com/

How to set SSL certificates in Windows?

Following are the steps to install an SSL certificate on Windows Server 2016: 

1. On the server (where the CSSR was created) save the SSL certificate .cer file (e.g. mydomain.cer)
2. Windows start menu > type Internet Information Services (IIS) Manager > Open
3. Click on the Connections menu tree > locate and Click on the server name
4. Server name Home page > Action Menu > Click complete certificate Request
5. In the Complete Certificate Request wizard > on the Specify Certificate Authority Response page > File name containing the certificate authority’s response > Click the box and select the .cer file
6. Type a Friendly name for the certificate, (the friendly name is used to identify the certificate by adding the CA and expiration date.
7. Select a certificate store for the new certificate: In the drop-down list, select Web Hosting.
8. Certificate Installed successfully.
9. Now, to assign the certificate to an appropriate site > go to Internet Information Services (IIS) Manager > Connections Menu > expand the name of the server on which the certificate was installed > expand Sites > select the sites to secure the SSL certificate

   9.1.1 On the website Home page > Actions menu > Edit Site.. click bindings link

10. Site Binding Window > click Add
11. In the Add Site Bindings window, do the following:

    Type: In the drop-down list > Select https

    IP address: Select the IP address of the site or select All Unassigned.

    Port: Type port 443. The port over which traffic is secure by SSL is port 443.

    SSL certificate: In the drop-down list, select your new SSL certificate (e.g. mydomain.com).

12. SSL Certificate is now installed successfully.
13. Using different browsers, visit the site with the secure https URL to verify the SSL certificate is working correctly.

How do you renew an SSL certificate?

Renewing a certificate is, technically, purchasing a new certificate for
the domain and company. As per the industry standards, certificates comes with
an expiration date. When the certificate expires, it is no longer valid. So,
when you “renew” a certificate, the certificate authority must issue a new one
to replace the expiring one, and the new certificate must be installed on the
server.

There are two procedures to renew the certificate:

• Renew a self-signed certificate
• Renew a certificate from a CA

Renew a self-signed certificate

• On your windows Server, click on the Start menu > go to Administrative Tools > click on Internet Information Services (IIS) Manager.
• Click on the name of the server in the Connections column > Double-click on Server Certificates.

• In the Actions column on the right > click on Create Self-Signed Certificate

• Enter any friendly name and then click OK.

• The self-signed certificate has been created, and it is valid for 1 year and listed under Server Certificates.

• Now, bind the self-signed certificate to the site. Go to Connections (left column)> expand the sites folder > click on the website that you want to bind the certificate to > Click on Bindings in the right column under Actions.

• Click on Bindings > On the Site Bindings window > click on the Add
• Change the Type to https > select the SSL certificate that you just installed > Click OK.

• Binding for port 443 is now listed.

• Now, to add your self-signed certificate in the Trusted Root Certificate Authorities. Open Microsoft Management Console (MMC), create a Certificate snap-in for the Local Computer account (see the steps in the How Do you Find your SSL Certificate? section above)
• Under Certificates > expand Personal > Click on the Certificates folder > Right click on the self-signed Certificate > Copy

• Underneath Trusted Root Certification Authorities folder > click the Certificates folder > Right-click in the white area below the certificates and click Paste.

Renew a certificate from a CA

In this example we will show you how to renew the Root certificate from your CA.

• Navigate to the Microsoft Management Console (MMC) of your windows server > start the Certification Authority snap-in > Right click the name of the Certificate Authority > All Tasks > Renew CA Certificate.

• The Install CA Certificate warning pops up, which informs us that Active Directory Certificate Services must be stopped. Select Yes.

• On the Renew CA Certificate window, either choose to use the existing CA key pair or generate a new key pair for certificate renewal. The default option is to reuse the current public and private key pair.

• To check if the certificate is Renewed, Right click the name of the Certificate Authority > Properties > General

How can Encryption Consulting help?

Encryption Consulting provides a specialized Certificate Lifecycle management solution CertSecure Manager. From discovery and inventory to issuance, deployment, renewal, revocation, and reporting. CertSecure provides an all-encompassing solution. Intelligent report generation, alerting, automation, automatic deployment onto servers, and certificate enrollment add layers of sophistication, making it a versatile and intelligent asset.

Conclusion

A website needs an SSL/TLS certificate to keep user data secure, verify ownership of the website, prevent attackers from creating a fake version of the site, and gain user trust. SSL/TLS certificates verify that a client is talking to the correct server that owns the domain. This helps prevent domain spoofing and other kinds of attacks.

Introduction

Almost all companies rely on cryptographic keys and digital certificates to keep communications between devices secure and confidential. Digital certificates and keys solved the problem of communicating back and forth securely on the Internet.

SSL/TLS certificates enable devices and systems to be uniquely identified and trusted. To keep digital communication safe, private communication tunnels are created using encryption that keeps digital communications safe across computer networks. Certificates and their associated keys control access to information in these private tunnels.

Hackers target certificates to utilize in their attacks because they know most companies have encryption tunnel blind spots. When attackers acquire access to certificates that have been stolen or faked, they obtain access to the globally trusted status provided by these digital assets, enabling them to gain access to private, encrypted tunnels through which they can monitor communications. Even with the help of these certificates, hackers can establish their encrypted tunnel for malicious activities.

Without the proper management of keys and digital certificates, Dangerous private tunnels carrying malicious traffic might be hidden among numerous tunnels carrying good traffic supporting daily operations.

Best Practices for Protecting SSL/TLS Certificates and Keys

• Identify and create SSL/TLS Certificates inventory

  You subject yourself to security threats if you don’t keep a strict inventory of your certificates, so start by keeping track of all the issued certificates from your Certificate Authority (CA). Manually, It can be challenging to ensure that you’ve collected everything, from internal CAs to network devices. To build an accurate inventory, Enterprises should automate a system that quickly scans the whole digital infrastructure to identify all digital assets, including where they are installed, who owns them, and how they are utilized. This will help you identify all certificates that may influence the reliability and availability of your company’s infrastructure.

• Monitor SSL/TLS Certificates

  Manual management of certificates becomes challenging as your networks evolve and the number of certificates increases. All of the certificates in your environment should be continuously checked for availability, expiration, and key strength in real-time synchronization with CAs, SSL network scans, and certificate store inventories.

• Automate certificate management

  Processes that rotate any or all keys and renew certificates on a planned or as-needed basis are required by strong security procedures. With automation, you can update all affected certificates, private keys, and CA certificate chains fast. You may also respond quickly to major security events like a CA compromise or a zero-day vulnerability in a cryptographic algorithm or library by automating the tasks. Automation helps prevent outages and saves time from manual tasks like certificate requests, issuance, provisioning, and renewal.

• Secure Private Keys

  When an attacker gets access to a private key, valuable data is leaked due to the impersonation of an enterprise’s servers. To ensure maximum security, never leave private keys in your logs, especially your email and chat, whether for storage or transmission and use a central key escrow, such as an encrypted software vault or Hardware Security Module (HSM).

• Enforce Policies

  Your security posture should contain a well-defined policy that specifies which application settings are required and how certificates should be used. Machine identity security policies and practices must be established to keep your machine identities safe. This helps manage all aspects of machine identities, including issuance, use, configuration, ownership, management, security, and decommissioning.

• SSL/TLS Certificate Vulnerabilities

  Increased threat intelligence is needed to provide a baseline for identifying vulnerable keys and certificates, such as those with weak encryption algorithms or short key lengths. A baseline can help identify applications that are served by vulnerable keys and certificates and certificates that are possibly compromised, unused, or expired and should be revoked or retired.

How can Encryption Consulting help?

Encryption Consulting provides a specialized Certificate Lifecycle management solution CertSecure Manager. From discovery and inventory to issuance, deployment, renewal, revocation, and reporting. CertSecure provides an all-encompassing solution. Intelligent report generation, alerting, automation, automatic deployment onto servers, and certificate enrollment add layers of sophistication, making it a versatile and intelligent asset.

What is an SSL Certificate?

SSL stands for Secure Sockets Layer; it is the standard technology for keeping an internet connection secure and safeguarding sensitive data between two systems. The two systems can be servers to clients (for example, a shopping website and browser) or server to server (for example, an application with personally identifiable information or payroll information).

An SSL certificate is a certificate signed by a trusted CA. The CA uses their private key to sign the certificate, including who the certificate is issued to, the validation period, and the public key. Since the public key is attached to the certificate, it proves the legitimacy of the public key so that it can be used for further secure communication between the web server and the client.

When SSL version 3.0 was updated, instead of being called SSLv4.0, it was renamed TLSv1.0.

How to check if an SSL certificate is valid?

An SSL certificate’s validity period is generally set to expire anywhere between one to three years. The validity period of the certificate entirely depends on criteria like the company policy and cost considerations.

There are multiple tools available to check the SSL certificate’s validity; in this article, we will see how you can check the certificate validity by yourself.

• Option 1: This process is time-consuming

  Run > certlm.msc > open Certificates Local Computer
  Go through the list of the certificates listed in the store to make sure only the legitimate ones are installed.

• Option 2: Download the Windows sysinternals utility

  Use the Windows Sysinternals utility called sigcheck > Download
  Once it is downloaded and installed > run the command sigcheck -tv
  Sigcheck downloads the trusted Microsoft root certificate list and provided outputs for only valid certificates.

Why does an SSL Certificate expire?

There has been a long debate and discussion going on regarding the question: Why do SSL certificates expire?  

There are various answers to this, however, the most essential and expected response is “Security.” A shorter life certificate helps mitigate compromises of keys, as new keys are generated every time you renew the certificate. It also ensures that all certificates are using the latest security standards. 

Some certificates last for a year or two, whereas others have expiry dates as low as 90 days. For many, these expiration dates can be a hassle. However, there are two reasons why limited-length certificates are necessary:

1. Renewing your certificate validates your website’s identity.
2. It makes sure the encryption you use is up to date, which keeps user’s data secure during transit.

Google has long argued the standard for SSL certificate expiration should be as short as one year. At one point, it was common for SSL certificates to last up to five years. It was a convenient approach, but not optimal from a security standpoint.

What happens when an SSL certificate Expires?

Now that you know why SSL certificates expire, you should also understand what happens when the SSL certificate expires. When you are using an expired SSL certificate, you risk your encryption and mutual authentication. The users and website both become vulnerable; it is easy for the hacker to misuse your website. 

For example, a user visits your website with an expired SSL certificate, and a warning sign will be displayed. Generally, there is an exclamation mark or a lock logo in google chrome with a message saying, “your connection is not private.” 

How to renew your SSL certificate?

The process of renewing an SSL certificate depends on what web host or Certificate Authority (CA) you are using. However, the big picture remains the same: you will generate a certificate signing request (CSR), activate the certificate, and install it. Let us talk about each step below:

• Step 1: Generating a New CSR (Certificate signing request)

  This is the first step to renew a certificate. Generate a CSR from your web host, which validates the server’s identity. If you are using cPanel, you can navigate to the Security tab and look for SSL/TLS option > go to Certificate signing request (CSR) > generate a new CSR; below are the detailed steps:

  • Log into your cPanel admin.
  • From the cPanel home page, go to the Security section, and then click SSL/TLS
    Under Certificate Signing Requests (CSR), click Generate, view, or delete SSL certificate signing requests.
  • Complete the fields in the Generate a New Certificate Signing Request (CSR) section.
  • At the bottom of the form, click the Generate button.
    On the new page, your CSR will display in the Encoded Certificate Signing Request section.
  • You will need to make a copy of the CSR to request an SSL certificate.

• Step 2: Choose the right SSL certificate for your website

  In this step, you will select a certificate you think is suitable for your site. As we know, various certificates carry different validation levels.

• Step 3: Validate your SSL certificate

  In this step, you need to confirm the ownership rights of your domain. There are three methods for domain control validation (DCV).

  • Email validation

    With this method, you will renew your SSL certificate using an email associated with the domain in question.

  • HTTP validation

    This validation process involves uploading a file to the server you want to install the certificate on.

  • DNS validation

    Using CNAME records, you can validate your SSL certificate.

  The most straightforward approach is email validation. You associate your email address with your domain and provide the same email address in the approver email field to complete the DCV. Once this is done, you will get a validation email within a few minutes.

• Step 4: Install your new SSL certificate

  For this step, you can refer to your installation guide or contact the hosting provider for support. However, below is an example of how to install an SSL certificate:

  • Launch cPanel admin.
  • In the Security section, click SSL/TLS.
  • Under Certificates (CRT), click Generate, view, upload, or delete SSL certificates.
  • Use the Upload Certificate section to upload the primary certificate (.crt file with randomized name) from your local machine and click Upload Certificate.
  • On the new page, click Go Back.
  • Scroll down to the bottom of the SSL Certificates page and click Return to SSL Manager.
  • Under Install and Manage SSL for your site (HTTPS), click Manage SSL Sites.
  • Scroll down to the Install an SSL Website and click Browse Certificates.
  • Select the certificate that you want to activate and click Use Certificate. This will auto-fill the fields for the certificate.
  • Scroll down to the bottom of the page and click Install Certificate.
  • On the Successfully Installed pop up, click OK.
    

To learn more about SSL/TLS certificates, check out:

1. https://www.encryptionconsulting.com/education-center/ssl-tls-certificates/#validity-check
2. https://www.encryptionconsulting.com/why-to-fix-expired-ssl-certificates/

How do you keep track of your SSL certificate expiration date?

You will always want to avoid a morning when you wake up and see the SSL security warning on your website.

• The quickest way to inspect your SSL certificate is directly from your browser by following the below steps:
  Go to your browser> Click the padlock next to the URL > Go to Certificate > Click on the general tab > check the certificate’s validity or the expiration date.

• Another way to track the SSL certificate expiration date is to log into your SSL account and check the “next due date.” 

How can Encryption Consulting help?

Encryption Consulting provides a specialized Certificate Lifecycle management solution CertSecure Manager. From discovery and inventory to issuance, deployment, renewal, revocation, and reporting. CertSecure provides an all-encompassing solution. Intelligent report generation, alerting, automation, automatic deployment onto servers, and certificate enrollment add layers of sophistication, making it a versatile and intelligent asset.

Conclusion

Maintaining a positive reputation for your brand and business is very important. Installing an SSL certificate and using HTTPS is a great start for securing your website. SSL certificates not only protect your information but also establish a positive mutual relationship with your customer.

Introduction

SSL & TLS are protocols that are used for the encryption of communication channels between network devices. SSL & TLS are used to bind the identities of systems, users, websites, etc., with the help of digital certificates. These digital certificates are either issued by internal trusted certificate authorities or public Certificate authorities. Internal certificates are trusted between networking devices within enterprise while public certificates are trusted by networking devices across the globe.

These certificates hold identities of end entities and contains a cryptographic key pair consisting a pair of public and private key. Public key is distributed along with the certificate whereas private keys are kept secured by the entities. A network channel is encrypted using these key pair which ensures that data communicated between these network devices are secured from tampering or altering.

However, with all these security in place there are always vulnerabilities, technology and process gaps that enable hackers to exploit and steal the data.  In this blog we are going to discuss some of the SSL/TLS challenges which are common to exploits.

SSL vs TLS

TLS (Transport Layer Security) is the successor to SSL (Secure Socket Layer) protocol for authentication and encryption. At present, TLS 1.3 is considered to be the most secure compared to it predecessors and is defined in RFC 8446.  SSL & TLS ver 1.2 are deprecated due to vulnerabilities and attacks to these protocols such as ROBOT, LogJam, & WeakHD.

These attacks have exploited the way key exchanges happen between client and server during the negotiation phase. These attacks have been mitigated with the introduction of TLS 1.2, however there are still vulnerable to downgrade attacks such as POODLE. These vulnerabilities have been mitigated in TLS 1.3 which protects the handshake during client-server negotiation.

What attacks does SSL/TLS prevent?

SSL/TLS is the defacto standard in internet/online security.  These protocols are used to encrypt data sent over the unsecured medium (the Internet) between a client machine and a server (a website hosted on a computer).  This prevents many types of attacks. Even if a hacker intercepts encrypted data, he/she can’t read it or use it for beneficial purposes without the private key used for the decryption process.

The hackers in the world continuously search for ways to break the defacto standards of internet i.e. SSl/TLS. SSL/TLS vulnerability’s highly rewarding nature makes the attackers put their best efforts forward, which places organizations at risk of breaches and unplanned system downtime. The following examples of attacks describe a few of the most common SSL/TLS exploitation techniques, their impact on businesses, and suggestions on how to prevent these attacks.

Following are the common SSL attacks explained

SSL Renegotiation Attack

SSL Renegotiation attacks aim to exploit the vulnerability discovered in the SSL renegotiation procedure, which allows an attacker to inject plaintext into the victim’s requests. Attackers who can hijack an HTTPS connection can add their own requests to the conversation between the client and server. The attacker cannot decrypt the client-server communication, so it is different from a typical man-in-the-middle attack.

To fix the renegotiation vulnerability for SSLv3, you must stop allowing renegotiation on the server side. A renegotiation indication extension, which fixes the vulnerability, was proposed for TLS that requires the client and server to include and verify information about previous handshakes in any renegotiation handshakes.

SSL/TLS Downgrade Attacks

An SSL/TLS downgrade attack tricks a web server into negotiating connections with previous versions of TLS that have long since been abandoned as insecure. The attacker then tries to intercept and/or alter the information by exploiting flaws in the older protocol versions or cryptographic algorithms.

Following are the most infamous Downgrade attacks in the history:

• Poodle Attack

  In the POODLE (Padding Oracle on Downgraded Legacy Encryption) attack, a vulnerability (CVE-2014-3566) is exploited to eavesdrop on communications encrypted with SSLv3. In this attack, the attacker can steal confidential data such as passwords, session cookies etc, to imitate a legitimate user. The recent Acunetix 2020 Web Application Vulnerability Report shows that as many as 3.9% of web servers are still vulnerable to POODLE as they are still using SSLv3 to encrypt their communication. To fix the POODLE attack on your web server, configure the web server to support TLS 1.2 or higher protocols.

• Freak Attack

  The FREAK (Factoring RSA Export Keys) attack works by exploiting the deliberately weak export cipher suites introduced to comply with US cryptography export regulation agencies. FREAK tricks the server into using an export cipher suite that uses RSA moduli of 512 bits or less. The earliest intention was to allow the cipher suites to be broken only by the National Security Agency however, this key can be easily cracked by today’s computing power. To fix this for your website, you must disable support for any export-grade cipher suites in software using SSL/TLS.

• Logjam Attack

  The Logjam attack, discovered in May 2015, allows an attacker to intercept an HTTPS connection by downgrading the connection to 512-bit, export-grade Diffie-Hellman groups. This is similar to the FREAK attack, except that Logjam attacks the Diffie-Hellman key exchange instead of the RSA key exchange, as is the case in Freak attack. To overcome this, you must disable support for all export-grade Diffie-Hellman cipher suites on your servers. This won’t allow an attacker downgrade the connection to the 512-bit DH export key.

Drown Attacks

DROWN is a serious vulnerability that targets servers supporting contemporary SSL/TLS protocol suites by exploiting their support for obsolete and insecure protocols. This allows attackers to leverage an attack on connections using up-to-date protocols that would otherwise be secure. DROWN exploits a vulnerability in the protocols and configuration of the server, rather than any specific implementation error.

DROWN gives attackers the ability to break the encryption, and read or steal sensitive communications. To protect against DROWN attack, server owners need to ensure that their private keys are not used anywhere with server software that allows SSLv2 connections. Web servers, SMTP servers, IMAP, and POP servers are all examples that supports SSLv2 connections.

Truncation attack

A TLS truncation attack blocks a victim’s account logout requests so that the user unknowingly remains logged into a web service. When the sign out request is sent, the attacker injects an unencrypted TCP FIN message to close the connection. The server does not receive the logout request, and is unaware of the abnormal termination. To prevent this, SSLv3 onward has a closing handshake, so the recipient knows the message has not ended until this has been performed.

Sweet32 Attack

The Sweet32 attack breaks 64-bit block ciphers used in CBC mode by exploiting a “birthday attack”. In order to execute birthday attack, the attacker uses “man-in-the-middle” attacks or injects malicious JavaScript into a web page to capture enough traffic to mount a birthday attack. To protect against Sweet32 attack, avoid the usage of legacy 64-bit block ciphers, and disable cipher suites using DES/3DES.

MITM (Man in The Middle Attack)

Man in the middle (MITM) attacks occur when a hacker is able to get unauthorized access and intercept the secure communication between the sender and the receiver.  There are many ways by which a hacker is able to perform MITM attacks, which include getting access to SSL/TLS private keys that bind the certificate authenticity and unsecured end points. In some case, poorly secured Intermediate Certificate Authority’s private keys can get compromised, leading to a much bigger impact on all the certificates issued by them.

 In some cases, MITM attacks can also happen if the end point system is vulnerable and an attacker is able to add a fake trusted Root CA certificate in the trusted root authority list.Many organizations are not able to manage certificate life cycles, leading to compromised or expired certificates not getting revoked or renewed. In such a case, there is a high possibility that an attacker will continue using such revoked certificates to establish trust with a compromised sites and be able to eavesdrop on communications on secured channels.

SSL Stripping attacks

In SSL Stripping, an attacker establishes theirself as a router and establishes HTTPS connections with Internet servers. Usually, the end-user connects with the attacker over the unsecured HTTPS connection believing it’s an authenticated router. The attacker is then able to read the communication, forward the request to the server, and pass the response back to the user. The intent of such attacks is to read data such as usernames, passwords, and any payment related data that the attacker can later exploit.

SSL Hijacking attacks

Session hijacking, also known as cookie hijacking, is the exploitation of a valid session by gaining unauthorized access to the session key/ID information. In the process, when the user tries to login to the web application, the server sets a temporary remote cookie in the client’s browser to authenticate the session. This enables the remote server to remember the client’s login status. In order to execute session hijacking, a hacker needs to know the client’s session ID information. This can be obtained in different ways, such as by tricking the user into clicking a malicious link that contains a prepared session ID.

Through both methods, the attacker can take over the targeted session by using the stolen session ID in their own browser session. Eventually, the server is tricked into thinking that the attacker’s connection is the same as the real user’s original session. To protect yourself against SSL hijacking, avoid connecting to non-secure (HTTP) urls, be careful while connecting to the public wi-fi, use secure cookie flag, use anti-malware on clients as well as server machines, and time-out inactive sessions.

SSL/TLS Vulnerability Attacks

Like we have with other protocols, SSL/TLS protocols also have their share of flaws. Below are attacks which affect SSL/TLS 1.2 and older versions.

• BEAST Attack

  BEAST (Browser Exploit Against SSL/TLS) attacks affect SSL 3.0 and TLS 1.0 by exploiting the vulnerability (CVE-2011-3389). In this attack, the attacker can exploit a vulnerability in the implementation of CBC (cipher block chaining) in TLS 1.0. This enables the attacker to decrypt the encrypted data between two users/systems by injecting the crafted packets into TLS streams using MITM techniques.

  These techniques allow the attacker to guess the initialization vector used with the injected message. They can then compare the results to the ones in the block that they want to decrypt. This attack requires access to the client’s (victim) machine browser as a prerequisite. To execute this attack successfully, the attacker might use some other attack vectors in the initial stages. To overcome this attack, use browsers that support TLS 1.1 or higher.

• CRIME Attack

  In CRIME (Compression Ratio Info Leak Made Easy) attacks, the mechanism of compression algorithms is exploited, which is covered under the vulnerability (CVE-2012-4929). In general, the compression method is included in the server hello message in response to the client hello message, to reduce the bandwidth requirement for the data exchange. To facilitate this process, the server sends the “Compression method” (DEFLATE is most commonly used) to the client, whereas the server sends the “NULL” compression method to the client if there is no compression required.

  One of the primary techniques used by compression algorithms is replacing the repeated byte sequences in the message with a pointer to the first instance of that sequence. The bigger the repeated sequences are, the higher the compression ratio. To fix this attack, use your browser to support the latest TLS protocol (TLS 1.3).

• BREACH Attack

  The BREACH (Browser Reconnaissance and Exfiltration via Compression of Hypertext) attack is aimed at exploiting the mechanism of compression used by HTTP rather than TLS, as is the case in CRIME attacks. This vulnerability is listed under the NIST NVD database as CVE-2013-3587. This vulnerability can be exploited even when the TLS compression is turned off. This is done by redirecting the client (victim) browser’s traffic to any third-party url which is TLS enabled, and monitoring the traffic between server and client using MITM attack techniques. The web servers that are using HTTP compression reflect user input/secrets in HTTP response bodies, and are prone to being vulnerable to this. To control this vulnerability, you may disable HTTP-level compression, separate secrets from user inputs, and masks secrets.

• HEARTBLEED Attack

  Heartbleed was a critical attack that uncovered the vulnerability in the heartbeat extension of the openssl library, and is listed under the NIST NVD database as CVE-2014-0160. The heartbeat extension is used to keep a connection alive as long as both parties are still there.

  Let’s understand the Heartbleed functionality in openssl library. The client sends the heartbeat message with the data and size to the server. The server then responds back with the client’s data received and size data. The Heartbleed vulnerability was aimed to exploit the fact that if the client sends a fake data length to the server, then the server would respond back with some random data from its memory to meet the length requirement specified by the client.

  The random unencrypted data from the server’s memory may contain critical information, such as private keys, credit card details, and other sensitive information. To fix the Heartbleed vulnerability, either upgrade to the latest version of openssl library or recompile the installed version with the flag “DOPENSSL_NO_HEARTBEATS”.

How to protect from SSL Attacks?

As explained in the above sections regarding some of the common SSL attacks, it is important that organizations review their security policies related to SSL protection.  Just by implementing SSL or TLS does not ensure the security of your infrastructure and business. It must, instead, be managed with the right policies, processes, & procedures to minimize risks. In addition, there are multiple techniques and tools available in the market in order to secure your enterprise. The selection of those tools/security products, however, is a function of the nature and security goals of your enterprise and should be decided after thoroughly investigating every aspect of security.

Common causes of attacks in an enterprise network

Avoid Self-signed certificates

Many times, systems are configured to use self-signed certificates that are not signed or issued by an authorized and trusted Certificate Authority. Such self-signed certificates do not have the valid credentials or information of the certificate issuer. They might also be using weak & deprecated algorithms such, as SHA1 or RSA algorithms, with weak key strengths.  Such servers are easy to exploit for attacks, and a malicious user may be able to host malicious code on such. Self-signed certificates should only be used for testing and never in production systems. Also, a server should never trust self-signed certificates.

Avoid Wildcard Certificates

Usage of a wildcard certificate on a public facing webserver increases the risks to an organization that hackers will use the server to host malicious websites in various malicious campaigns. To overcome this issue, organizations should avoid using wildcard certificates on production systems, especially public-facing ones. Instead, use specific certificates for each domain and sub-domain.

Avoid unknown Certificate Authorities

To maintain trust between both the parties depends upon the trustworthiness of a CA. In the real world, lots of customers might rely on CAs which are unknown and not popular in the market because they provide cheaper solution. This may cost them (customers) in the long run as attackers might compromise those CAs and impersonate the legitimate CA to steal lots of critical information. To protect from this, organizations should identify all the CAs and certificates from unknown and untrusted sources, and discard or replace them with CAs and certificates from trusted sources.

Attacker using encrypted communication

In the current world, attackers use encryption as a tool against organizations. More and more cybercriminals are using SSL/TLS encrypted communication to implant malwares in enterprise networks and systems. As this trend is gaining momentum, one of the Gartner reports says that 50% of network attacks targeting enterprises will use encryption.

This will become a cumbersome job for the enterprises to inspect and decrypt this kind of traffic, specifically when they don’t have the ability to do so. To overcome this, organizations should leverage network security solutions to impose outbound web policies on SSL traffic. They also should carefully distinguish between which encrypted traffic profiles should be considered for decryption in both the inbound and outbound direction.

Avoid using expired SSL/TLS Certificates

Expired SSl/TLS certificates are the most common cause of service outages across the globe. Microsoft encountered an infamous service outage in their Azure service and had to give service credits to their customers, causing them huge losses. Expired certificates also cause organizations to be vulnerable to MITM (Man-in-the-Middle) attacks, as attackers can easily take advantage of expired certificates.

To protect your organization from this, all expired certificates should be immediately taken out of the system and replaced with active/valid certificates.

Avoid Phishing Attacks

Phishing attacks aim to exploit the human emotions vulnerability to trick them and provide sensitive/personal information to attackers. When users get a link in a form such as html to provide some personal information about themselves, they should note whether the link is secured or unsecured. A secured link has “https” in the address bar, whereas unsecure link have “http” only.

To protect yourself from these kind of phishing attacks, SSL/TLS gives you a warning message if the html page you are trying to access is unsecured. Also, if you are leaving a secured page and going to an unsecured page, SSL/TLS still gives you a warning. As a best practice, users should always use authentic urls/websites to avoid phishing attacks.

Use Strict SSL

In Strict SSL, also known as full SSL, additional validation as to the identity of the origin server is performed in order to prevent active snooping and modification of your traffic on the Internet.  In the real world, SSL/TLS encrypts the communication between the client and website/ server. However, MITM attacks trick users/clients into interacting with the fake counterpart of the legitimate website/server unknowingly. That’s where the Strict SSL comes into the picture. SSL enforces the client’s browser to check the authentication certificate of any website to make sure if it has a valid certificate. MITM attacks cannot alter the authentication certificates, hence the purpose of full SSL is served.

How can Encryption Consulting help?

Encryption Consulting provides a specialized Certificate Lifecycle management solution CertSecure Manager. From discovery and inventory to issuance, deployment, renewal, revocation, and reporting. CertSecure provides an all-encompassing solution. Intelligent report generation, alerting, automation, automatic deployment onto servers, and certificate enrollment add layers of sophistication, making it a versatile and intelligent asset.

This guide will take you through the entire process, from selecting the right type of certificate based on your needs to navigating the verification and installation steps. Whether you need a basic domain validation (DV) or a high assurance extended validation (EV) certificate, understanding the process helps you make informed decisions and ensure your certificate meets your specific requirements. This blog will also explore best practices for managing your certificates to maintain compliance and security. 

The process of purchasing a Certificate from a CA

The following steps outline how to purchase a certificate from a CA: 

Step 1: Choose the Right Type of Certificate

It is important to note that not every SSL certificate is identical. Certificates vary in validation level and security assurances, so the first step is to determine which level of trust and validation your website needs based on where it will be used and who will use it. The right type of certificate can be one of the following:

Certificate Type	Benefits	Drawbacks
Domain Validated (DV)	Cost-effective, making it accessible to small businesses and individuals.	Limited user trust as no organizational information is verified.
	Quick and straightforward issuance, often within minutes.	It is not suitable for websites handling sensitive information like payment or personal data.
	Sufficient for basic websites with static content or low-risk operations.	It may not comply with the strict security policies of certain industries or users.
	Widely supported by all major browsers and platforms.	Provides no visual cues for users (like the organization name in the address bar).
Organization Validated (OV)	Verifies the identity and existence of an organization, increasing customer trust.	Longer verification process compared to DV certificates.
	Provides moderate assurance suitable for business and informational websites.	Do not display organization details prominently in the browser address bar.
	Shows the organization’s identity in the certificate details, allowing users to confirm authenticity.	It may not be sufficient for e-commerce, financial services, or other high-security applications.
	Balances cost and security, making it suitable for small and medium businesses.	Requires additional documentation, which can delay issuance.
Extended Validation (EV)	It offers the highest level of trust and security by thoroughly validating the organization’s identity.	It is expensive compared to DV and OV certificates, potentially a barrier for small businesses.
	For authenticity, it displays the organization name in the browser’s address bar.	The issuance process is lengthy, often taking several days or weeks.
	It is ideal for handling sensitive data like financial transactions and log-in.	It requires extensive documentation, making the process more complex and time-consuming.
	It also boosts SEO rankings and enhances user trust, improving conversions.	It is inflexible for urgent needs due to detailed verification.
	It ensures compliance with strict industry data protection regulations.	Frequent renewals may be needed due to detailed validation.

Step 2: Choose a Reputable Certificate Authority (CA)

Picking a trustworthy Certificate Authority (CA) is key to ensuring safe and reliable online activities. Go for a CA that has a good reputation, works well with most browsers, and quickly fixes any security issues to keep users’ trust. Make sure the CA uses strong encryption methods and is regularly audited to ensure compliance with security regulations. Look for CAs that have easy-to-use tools for managing, renewing, and keeping track of certificates. Also, check that the CA offers strong customer support to help with technical issues or emergencies.

Consider the types of certificates offered by the CA, such as domain validation and extended validation certificates, to match your business needs. Ensure they also support additional features like code signing and email signing certificates if necessary. Well-known CAs often provide better resources and have a proven track record in the industry.

At the same time, it is important to avoid red flags when choosing a CA. Avoid CAs that lack clear and transparent policies on encryption standards, certificate issuance, or revocation processes. Limited browser compatibility or a history of slow responses to vulnerabilities are signs of potential issues. Additionally, avoid CAs with negative reviews, a poor reputation, or inadequate customer support that could leave you stranded during critical moments. By evaluating these factors carefully, you can select a CA that provides strong security and builds trust with your website users.

Step 3: Create a Certificate Signing Request (CSR)

When you have chosen the appropriate certificate type and CA, the next step is to create a Certificate Signing Request (CSR). A CSR refers to an encrypted block of text, which is created on the server and contains your organizational information and your public key that the CA will use in the certification creation. The CSR is essential because it allows the CA to verify your identity and prepare a certificate that securely ties your domain to your organization.

Are you wondering how to generate a CSR? Do not worry. The following steps can brief you:

1. Access your server: Log in to the server where your website is hosted.

2. Generate the CSR: Depending on your server type, you will use different commands, e.g., OpenSSL for Apache servers, to create a CSR file.

3. Provide accurate information: This will include your domain, company name, and contact information. Make sure these details are the ones you used when registering with the CA.

Step 4: Submit the CSR to your chosen CA

With your CSR at hand, you are now ready to submit it to the CA. At this stage, however, you will have to verify yourself with respect to the type of certificate you are requesting.

• For DV certificates: You will only need to demonstrate that you own the domain, which can be done by email verification or DNS modification.

• For OV and EV certificates: Be prepared to submit official documents such as company registration or proof of the existence of the organization.

Once all the materials are submitted to the CA, it confirms the ownership of the domain and, if necessary, the organization’s authenticity for OV and EV certificates. Once verified, the CA will issue your certificate.

Step 5: Download and Install the Certificate

The moment the CA has finished conducting the evaluation process, the next thing that they will do is issue a certificate for you. Here is what you should do:

• Download the certificate files provided by the CA.

• Install the certificate on your server. This would differ depending on the hosting environment that you are working in. If you are not sure, most CAs have installation guides, and where possible, your web host may also be able to help.

• Test your installation to confirm that everything has been set up correctly. Many CAs provide and accept requests to check whether the SSL installation on the website has been successfully completed using certain online resources.

Step 6: Keep your Certificate Renewed

Understanding certificate validity and proper management is essential to reducing the risk of outages and expired certificates. SSL certificates usually last 1–2 years, but their lifespans are getting shorter, with future standards potentially bringing them down to just 47 days. While this increases renewal frequency and costs, shorter lifespans reduce the window for potential vulnerability exploitation by limiting the time attackers have to compromise a certificate.

To prevent expiration, proper certificate management is crucial. Automated certificate management solutions can make renewals seamless, lighten the workload for IT teams, and protect against costly breaches or downtime. Many CAs also provide reminders and easy renewal processes to help maintain trust and keep operations secure.

Best Practices for SSL/TLS Certificate Management

SSL/TLS certificates play a critical role in securing your website and sensitive data. To ensure your certificates remain valid, trusted, and compliant with industry standards, it is important to adopt the following best practices for SSL certificate management.

• Choose Reliable Certificate Authority (CA): Select trusted CAs that offer strong products and robust SSL management tools with quick vulnerability response times, thorough audits, and comprehensive client support.

• Select the Right SSL Certificate Type:

  1. DV: For static websites or personal blogs.

  2. OV/EV: This is for organizations needing stronger authentication. EVs are ideal for e-commerce and high-security sites.

  3. Avoid multi-server and wildcard certificates due to the risks of private key sharing.

• Optimize Server Configuration: Regularly review configurations and update cryptographic algorithms and SSL/TLS versions. You can use TLS server tests and patches on your systems to stay secure.

• Implement effective Certificate Management: Use a Certificate Management System (CMS) such as Encryption Consulting’s CertSecure Manager for full lifecycle visibility, automated monitoring, and expiration alerts. Maintain an inventory of certificates, including locations and ownership.

• Ensure proper Domain Ownership Verification: Confirm you can access the domain’s email (admin@domain) or DNS to verify ownership for SSL issuance.

• Use strong key lengths (2048-bit or Higher): For robust security, ensure your private key is at least 2048 bits. This helps protect against potential cryptographic attacks.

• Store private keys in Hardware Security Modules (HSMs): For maximum security and tamper resistance, store your private keys in HSMs. If HSMs are not available, use encrypted software storage with access controls and key management systems (KMS) like AWS Key Management Service. Regularly rotate keys, secure backups, and monitor usage to ensure ongoing protection.

• Reissue certificates if your private key is compromised: If your private key is lost or stolen, reissue the certificate immediately to maintain security.

• Monitor expiry dates: Regularly check the expiration dates of your certificates and set reminders for renewals. An expired certificate can cause trust issues for visitors.

• Ensure your site supports HTTPS: Before enabling HSTS, confirm that your site has a valid SSL certificate and that all content is served over HTTPS. If your site is not yet configured for HTTPS, you will have to obtain an SSL certificate and properly configure your server to use it.

• Enable HTTP Strict Transport Security (HSTS): Once your SSL certificate is installed, enable HSTS to instruct browsers to always connect over HTTPS, preventing man-in-the-middle attacks. To operate HSTS, you must provide an additional response header for your website. It means that you need to configure your web server to include a specific piece of information (called a “response header”) in its replies to browsers or user agents that request content from your site. This header is a set of instructions that tells the browser how to handle connections with your website, specifically enforcing secure HTTPS connections.

  This is the header you will be required to insert on your website:

    
    Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
  
  

  Once this is implemented, it will not permit the website to have any connection as HTTP (insecure) as it changes all URLs starting with HTTP to their secure counterpart, HTTPS.

• Avoid Wildcard certificates for sensitive subdomains: Wildcard certificates cover multiple subdomains but may not be ideal for sensitive subdomains (e.g., log-in or payment pages) because a single compromised key can affect all the subdomains. Using individual certificates for sensitive areas ensures better security, control, and compliance.

• Regularly update your SSL/TLS Configurations: As new vulnerabilities emerge, periodically check and update your SSL/TLS settings to ensure optimal security. Moreover, it’s recommended to review and update your SSL/TLS configurations at least every quarter. This proactive approach ensures that any emerging vulnerabilities are addressed promptly, keeping your site secure.

• Consider Multi-Domain (SAN) Certificates: If you have several domains or subdomains, a multi-domain SSL certificate (SAN) might be more cost effective than purchasing individual certificates for each.

How can Encryption Consulting help?

CertSecure Manager by Encryption Consulting is a specialized Certificate Lifecycle management solution that helps manage the entire life cycle of digital certificates. It automates issuance, deployment, renewal, monitoring, and revocation processes involved in the certificate lifecycle. This automation minimizes risks associated with human errors, like expired certificates or misconfiguration, that can lead to service disruptions or security vulnerabilities.

Conclusion

It may feel complicated to get an SSL certificate from a regulatory authority. However, it is simple, and it offers a lot of security and trust. With these steps, you will have no problem securing your website, protecting the data of your clients, and restoring your trustworthiness with the users. This is important for everyone, whether you are running a small blog or an e-commerce site. The right SSL certificate will play a fundamental role in making the internet environment safe and trustworthy. 

If you are uncertain about the best encryption practices or need personalized guidance, Encryption Consulting is here to help. We provide expert support to ensure your website is securely protected and fully compliant with industry standards.