Risk
2/12/2014
10:43 AM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Entrust Provides Answer To Deprecation Of Non-FQDN SSL Certificates

Entrust has introduced Private SSL Certificates that provide a method for the continued use of nonregistered domain names

DALLAS, Feb. 12, 2014 /PRNewswire/ -- The use of non-fully qualified domain names (FQDN) in publically trusted certificates is being deprecated by November 1, 2015, and existing certificates containing non-FQDNs will be revoked by all public certification authorities by October 1, 2016. To help simplify this change, Entrust, Inc. introduces Private SSL Certificates that provide organizations an easy and affordable method for the continued use of non-registered domain names.

"While this is an important change to help strengthen the CA trust infrastructure, Entrust strongly believes there should be simple means for organizations to properly adapt to the new policies," said David Rockvam, Entrust Senior Vice President of Product Management and SaaS Offerings. "This new type of internal SSL certificate helps ensure security is not compromised and wholesale changes aren't required within the organization."

Per the CA/Browser Forum's latest Baseline Requirements, publicly trusted SSL certificates that use non-registered domains represent security vulnerabilities in the SSL trust chain. As a convenience for users, many servers in corporate networks are reachable by local names such as "mail," "wiki" or "hr." Most publicly trusted certificates for non-unique names are deployed in the context of local networks to enable trust in these local names without the additional cost of provisioning a new trust root to clients.

This may be especially desirable for networks lacking centralized policy deployment and management tools, such as "Bring Your Own Device" environments.

Unfortunately, even these legitimate deployments come with hidden dangers, and such certificates are frequently misused.

To combat this vulnerability, Entrust Private SSL Certificates provide the same key sizes, signing algorithms, validity periods and CA protection as Entrust's proven publicly trusted SSL certificates -- all issued via a private shared CA that ensures no two names are alike.

As an alternative, an organization also may elect to switch all internal SSL certificates to FQDNs and continue to use publically trusted SSL certificates.

Root certificate trust is automatically delivered by the operating system or the browser without the organization's IT involvement. Properly changing domain names, however, could take an extended period of time -- or even break integrations -- as they may be hard-coded into existing applications.

To help organizations understand the changes, Entrust offers a complimentary white paper, "Guidance on Non-FQDNs: The Deprecation of Internal Server Names and Reserved IP Addresses," which explains the policy modifications, why it was implemented and recommendations for possible options moving forward under the new requirements.

Entrust Certificate Services provide organizations with SSL and specialty digital certificates that are proven, cost-effective and supported by standards-based technology. Entrust's public root is ubiquitous on more than

99.9 percent of desktop and mobile browsers.

To learn more about Entrust Private SSL Certificates, visit entrust.com/PrivateSSL.

<>

About Entrust

A trusted provider of identity-based security solutions, Entrust secures governments, enterprises and financial institutions in more than 5,000 organizations spanning 85 countries. Entrust's award-winning software authentication platforms manage today's most secure identity credentials, addressing customer pain points for cloud and mobile security, physical and logical access, citizen eID initiatives, certificate management and SSL. For more information about Entrust products and services, call 888-690-2424, email entrust@entrust.com or visit www.entrust.com.

Entrust is a registered trademark of Entrust, Inc. in the United States and certain other countries. In Canada, Entrust is a registered trademark of Entrust Limited. All Entrust product names are trademarks or registered trademarks of Entrust, Inc. or Entrust Limited. All other company and product names are trademarks or registered trademarks of their respective owners.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-7178
Published: 2014-11-28
Enalean Tuleap before 7.5.99.6 allows remote attackers to execute arbitrary commands via the User-Agent header, which is provided to the passthru PHP function.

CVE-2014-7850
Published: 2014-11-28
Cross-site scripting (XSS) vulnerability in the Web UI in FreeIPA 4.x before 4.1.2 allows remote attackers to inject arbitrary web script or HTML via vectors related to breadcrumb navigation.

CVE-2014-8423
Published: 2014-11-28
Unspecified vulnerability in the management portal in ARRIS VAP2500 before FW08.41 allows remote attackers to execute arbitrary commands via unknown vectors.

CVE-2014-8424
Published: 2014-11-28
ARRIS VAP2500 before FW08.41 does not properly validate passwords, which allows remote attackers to bypass authentication.

CVE-2014-8425
Published: 2014-11-28
The management portal in ARRIS VAP2500 before FW08.41 allows remote attackers to obtain credentials by reading the configuration files.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?