Risk
2/12/2014
10:43 AM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Entrust Provides Answer To Deprecation Of Non-FQDN SSL Certificates

Entrust has introduced Private SSL Certificates that provide a method for the continued use of nonregistered domain names

DALLAS, Feb. 12, 2014 /PRNewswire/ -- The use of non-fully qualified domain names (FQDN) in publically trusted certificates is being deprecated by November 1, 2015, and existing certificates containing non-FQDNs will be revoked by all public certification authorities by October 1, 2016. To help simplify this change, Entrust, Inc. introduces Private SSL Certificates that provide organizations an easy and affordable method for the continued use of non-registered domain names.

"While this is an important change to help strengthen the CA trust infrastructure, Entrust strongly believes there should be simple means for organizations to properly adapt to the new policies," said David Rockvam, Entrust Senior Vice President of Product Management and SaaS Offerings. "This new type of internal SSL certificate helps ensure security is not compromised and wholesale changes aren't required within the organization."

Per the CA/Browser Forum's latest Baseline Requirements, publicly trusted SSL certificates that use non-registered domains represent security vulnerabilities in the SSL trust chain. As a convenience for users, many servers in corporate networks are reachable by local names such as "mail," "wiki" or "hr." Most publicly trusted certificates for non-unique names are deployed in the context of local networks to enable trust in these local names without the additional cost of provisioning a new trust root to clients.

This may be especially desirable for networks lacking centralized policy deployment and management tools, such as "Bring Your Own Device" environments.

Unfortunately, even these legitimate deployments come with hidden dangers, and such certificates are frequently misused.

To combat this vulnerability, Entrust Private SSL Certificates provide the same key sizes, signing algorithms, validity periods and CA protection as Entrust's proven publicly trusted SSL certificates -- all issued via a private shared CA that ensures no two names are alike.

As an alternative, an organization also may elect to switch all internal SSL certificates to FQDNs and continue to use publically trusted SSL certificates.

Root certificate trust is automatically delivered by the operating system or the browser without the organization's IT involvement. Properly changing domain names, however, could take an extended period of time -- or even break integrations -- as they may be hard-coded into existing applications.

To help organizations understand the changes, Entrust offers a complimentary white paper, "Guidance on Non-FQDNs: The Deprecation of Internal Server Names and Reserved IP Addresses," which explains the policy modifications, why it was implemented and recommendations for possible options moving forward under the new requirements.

Entrust Certificate Services provide organizations with SSL and specialty digital certificates that are proven, cost-effective and supported by standards-based technology. Entrust's public root is ubiquitous on more than

99.9 percent of desktop and mobile browsers.

To learn more about Entrust Private SSL Certificates, visit entrust.com/PrivateSSL.

<>

About Entrust

A trusted provider of identity-based security solutions, Entrust secures governments, enterprises and financial institutions in more than 5,000 organizations spanning 85 countries. Entrust's award-winning software authentication platforms manage today's most secure identity credentials, addressing customer pain points for cloud and mobile security, physical and logical access, citizen eID initiatives, certificate management and SSL. For more information about Entrust products and services, call 888-690-2424, email entrust@entrust.com or visit www.entrust.com.

Entrust is a registered trademark of Entrust, Inc. in the United States and certain other countries. In Canada, Entrust is a registered trademark of Entrust Limited. All Entrust product names are trademarks or registered trademarks of Entrust, Inc. or Entrust Limited. All other company and product names are trademarks or registered trademarks of their respective owners.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8148
Published: 2015-01-26
The default D-Bus access control rule in Midgard2 10.05.7.1 allows local users to send arbitrary method calls or signals to any process on the system bus and possibly execute arbitrary code with root privileges.

CVE-2014-8157
Published: 2015-01-26
Off-by-one error in the jpc_dec_process_sot function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 image, which triggers a heap-based buffer overflow.

CVE-2014-8158
Published: 2015-01-26
Multiple stack-based buffer overflows in jpc_qmfb.c in JasPer 1.900.1 and earlier allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 image.

CVE-2014-9571
Published: 2015-01-26
Cross-site scripting (XSS) vulnerability in admin/install.php in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote attackers to inject arbitrary web script or HTML via the (1) admin_username or (2) admin_password parameter.

CVE-2014-9572
Published: 2015-01-26
MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 does not properly restrict access to /*/install.php, which allows remote attackers to obtain database credentials via the install parameter with the value 4.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
If you’re a security professional, you’ve probably been asked many questions about the December attack on Sony. On Jan. 21 at 1pm eastern, you can join a special, one-hour Dark Reading Radio discussion devoted to the Sony hack and the issues that may arise from it.