During the second half of 2010 VeriSign, Thawte, Geotrust and RapidSSL certificates will transition to use a 2048-bit root.

Loading mentions Retweet

The latest update to the SSL order system means that RapidSSL and Geotrust certificates now automatically secure the WWW and non-WWW domain in a single certificate.

Loading mentions Retweet

Over the last few months there has been a steady increase in support requests about re-issuing RapidSSL certificates and insurance.

RapidSSL certificates without insurance can be re-issued an unlimited number of times for the first 7 days after the certificate has been issued. This is not the day it was purchased from ServerTastic but the issuance date stated within the certificate.

This 7 day period is provided in case you have problems with installation and need to re-issue the certificate.

After these 7 days have passed it is not possible to re-issue the certificate unless you have insurance. If it is day 8 and you need to re-issue the certificate then sorry but you can't!

It is therefore important that if you are having installation problems during the first week that you seek assistance. If it is coming to the end of the first 7 days and you have not yet got the installation completed contact us and we can cancel the order and you can then start again. We are only able to cancel orders without charge within the first 7 days.

If you purchased your certificate without insurance it is possible to purchase re-issuance insurance directly from RapidSSL at a later date but this will cost more than purchasing a new RapidSSL from ServerTastic.

If you purchase your certificate with insurance then you can re-issue the certificate as many times as you want for the life of the certificate. You do not have to worry about server crashes, corruption or having to move server.

So it is important to note the following points when purchasing your certificate without insurance:

Loading mentions Retweet

Customers purchasing their RapidSSL, Geotrust, thawte or Verisign SSL certificate from ServerTastic are now able to manage their SSL certificate orders and perform the following actions:

Loading mentions Retweet

There have been a number of attacks aimed at SSL Certificates demonstrated at the recent Black Hat event in Las Vegas. VeriSign have confirmed that non of the certificates issued within the VeriSign group are susceptibale to these attacks. This includes RapidSSL , thawte and Geotrust.

This was confirmed on Tim Callans SSL Blog. I have pasted the relevent excerpts below

Use of null Characters

The focus of this presentation was various ways to use null characters to fool browsers and other pieces of relying software into believing a certificate has been issued to a different domain than the one to which is was actually issued. The idea is that the attack would give the online criminal the ability to put up a certificate on what appears to be the exact same domain name as the targeted site. sslstrip accomplishes this feat through a Man-in-the-Middle attack and uses the null-character certificate to create its false certificates on the fly.

I'm pleased to say that none of VeriSign's SSL Certificates on any brand allow null characters, meaning that you can't use any of our certificates in the attack detailed today. While the fundamental problem needs to be solved by the client software that trusts these certificates, we still prefer not to be contributing to the problem. And until these problems are solved at the source, EV SSL is a great interim solution. The detailed attack will not work against EV SSL (as agreed by Mr. Marlinspike during the Q and A session after his talk), which means that sites have the power to defend themselves against null character attacks and in fact all attacks using sslstrip.

MD2 No Longer Secure

Kaminsky covered several topics which had SSL as a common theme. Interestingly, he also revealed his own work with null characters, which was very similar to Marlinspike's. In addition, Kaminsky talked about pre-image attacks against MD2, which he expects to be viable this calendar year. He reports that MD2 is not trusted or soon to not be trusted on these applications and platforms: Firefox, OpenSSL, Red Hat, Opera, Apple, Microsoft, Google, and VeriSign. Here I can be more specific. As of May 2009, VeriSign is issuing its SSL Certificates on all brands using SHA-1.

Leading Zeros

Kaminsky also described a "leading zero attack," by which a certificate can fool client software by essentially attaching an invisible zero to the first hex character in the certificate. Again, I'm happy to tell you that VeriSign won't issue SSL Certificates with leading zeros on any of our brands.

Loading mentions Retweet

VeriSign have announced that they have issued 4 million SSL Certificates since 1995.

Full press release below:

In 14 Years as SSL Pioneer and Market Leader, VeriSign and Its Brands Make Trusted Interactions Possible for Millions of Web Sites and Services

MOUNTAIN VIEW, CA -- (Marketwire) -- July 27, 2009 -- VeriSign, Inc. (NASDAQ: VRSN), the trusted provider of Internet infrastructure services for the networked world, today announced that it has issued more than 4 million Secure Sockets Layer (SSL) Certificates. The total includes certificates issued by VeriSign under all four of its SSL brands: VeriSign®, GeoTrust®, thawte®, and RapidSSL®.

Since 1995, the company has served as a trusted third party and Certificate Authority responsible for issuing and authenticating a range of digital certificates designed to protect online businesses and their customers by:

 

--  Encrypting sensitive information during online transactions
--  Authenticating the identity of certificate owners
--  Warning when certificates are invalid
    

Under its four brands, VeriSign issues, authenticates and manages a range of certificates that are vital to the secure and trusted operation of the Internet, Web-based applications, and services requiring digital IDs, including:

 

--  SSL Certificates. VeriSign provides secure SSL encryption to Web sites
    protected by all VeriSign SSL Certificates brands, enabling trusted e-
    commerce, communications, and interactions on Web sites, intranets, and
    extranets.
--  Extended Validation (EV) SSL Certificates. EV SSL protection provides
    Web users using high security browsers with immediate visual confirmation
    that they've reached a site whose authenticity has been independently
    verified by VeriSign.
--  Server-Gated Cryptography (SGC) Certificates.  VeriSign's SGC
    Certificates enable every Web site visitor to connect using the strongest
    encryption for which their systems are capable.
--  Code Signing Certificates. VeriSign® Code Signing creates a digital
    "shrink-wrap" for code and content to protect software publishers and users
    when they download code and content over the Internet and mobile networks.
--  PKI Certificates. VeriSign protects enterprises, government agencies
    and others with a flexible platform enabling complete management of digital
    certificates for authentication, encryption and digital signing.
    

The milestone of issuing more than 4 million SSL certificates underscores how VeriSign is essential to enabling secure online transactions around the world. The company has issued more than 12,000 EV SSL Certificates, making VeriSign the far-and-away market leader with a 74 percent share of the EV SSL market. And every day, VeriSign conducts up to 1 billion Online Certificate Status Protocol (OCSP) checks -- the most timely and efficient way for Web browsers to determine whether an SSL or user certificate is still valid or has been revoked and a key indicator of secure sessions initiated using VeriSign SSL Certificates.

VeriSign also plays a vital role in Public Key Infrastructure (PKI) deployments, which use digital certificates for authentication, encryption and digital signing. In the past 14 years, VeriSign has issued and managed tens of millions of PKI certificates for thousands of customers throughout the world.

"As the world's leading SSL Certificate Authority, VeriSign understands that when customer trust is paramount, second best is never nearly good enough," said Tim Callan, vice president of product marketing at VeriSign. "Now more than ever, in a marketplace that is truly global and increasingly competitive, protecting a Web site, application or service with VeriSign is an investment that pays dividends every day."

 

Loading mentions Retweet

Promotion Ends 31st July 2009!

We are giving away, at random, 10 free RapidSSL certificates (1 year). To qualify for a chance to get a free certificate you must simply become a fan of ServerTastic on Facebook before 31st July 2009.

We will chose 10 fans at random and announce the winners on 5th August 2009 via Facebook.

Loading mentions Retweet

ServerTastic is now on Facebook! We have our own page where you can come and tell us how much you love, loathe or hate us (hopefully the former!)

We are a bit lonely at the moment and would really like you to show us some love. Simply click here and then click the "Become a fan" image. You can then post on our wall or start a discussion on the discussion boards.

Plus to help get you motivated we are offering a free RapidSSL certificate (1 Year) to 10 fans selected at random. To qualify for selection you must become a fan on or before 31st July 2009. Winners will be announced on 5th August 2009.

Loading mentions Retweet

Do not let your website carts get abandoned. Secure them with an appropriate SSL Certificate.

Loading mentions Retweet