sslnews.blogspot.com

Surveys are a great window into people’s minds, especially when they can illuminate contrasting, and even contradictory, behaviors in the same group. Results from the Symantec Online Internet Safety Survey have done just that. The most compelling finding – that respondents frequently proceed with online transactions they know might be insecure – inspired me to ask not just, “What are they thinking?” but “What are they thinking?!?”
The survey’s focus must be on many people’s minds, as we’ve had an extraordinary response – 301 people in just a few days! My initial impressions of the results are below. Feel free to share your comments and questions here.

Findings

Risky behavior remains common despite respondents knowing better: What struck me the most was that in many cases, respondents continued online transactions even when those transactions lacked security cues respondents knew should be there. For example, 80 percent of respondents knew to look for the padlock icon signifying Secure Sockets Layer (SSL) encryption, but only 55 percent said they would abort a transaction if they didn’t see it. Similarly, 81 percent knew to look for secure Internet connections (HTTPS) but only 56 percent got spooked by secure URLs not matching certificate domains (not an exact correlation, I know, but related). These are differences of nearly 30 points! What is driving this reckless behavior?

An equally notable figure is tha...

Twitter is slowly turning on automatic encryption on its website, a move following other major providers of web-based services to thwart account hijacking over wireless networks.

Twitter has offered an option for users to turn on SSL (Secure Sockets Layer) encryption, but said on Tuesday that it will turn the feature on by default for some users. It did not indicate when the option would be turned on by default for all users.
SSL encryption, indicted by "https" in the URL bar and sometimes a padlock in the browser window, is an encryption protocol used to protect communication between a client and a server. It is important to use because unencrypted information passed over wireless networks can be intercepted.

Many websites encrypt a person's login and password but will stop encrypting further data that is transmitted. A reason for not using SSL throughout a session is that it can occasionally slow interaction between the user and website.

Last year, a freelance web application Firesheep released, an add-on for Firefox that snatches cookies transmitted on unencrypted networks. Web sites drop a cookie, or a small data file, into a person's Web browser while they are logged into a session. Cookies are also used to "remember" people and keep them logged into the website.

Firesheep used an technique that was well-known but made it very easy for novice hackers to grab cookies and immediately log into a website as another pe...

Mozilla disabled MD5 in their environment from June 30, 2011 (https://wiki.mozilla.org/CA:MD5and1024). This means that any SSL certificates containing an MD5 signature algorithm will not work in later FireFox browsers after that date.

RapidSSL does not use the MD5 in the certificates we issue. However, it is possible that a small number of older certificates may contain an MD5 signature.

In the next few months RapidSSL will be communicating to any affected customers that they should reissue their certificate.

Reissuing your certificate is a simple process and will ensure your certificate contains a with a SHA-1 signature algorithm.

For instructions on reissuing your certificate please contact support team at http://www.clickssl.com

If your reputation in the online community depends upon the stringent safeguarding of information processed through your Web site, then your Internet security solution should include the strongest encryption available to each Web site visitor.

Encryption is the process whereby data is transformed into a code that will be indecipherable to an unauthorized viewer. The stronger the encryption, the more difficult it is for someone to eavesdrop on your online communications. This is especially important if you accept any kind of online payments, connect to a bank or brokerage account, transmit health records, must meet a governmental or other regulatory organization’s privacy and security standards, or process any kind of potentially sensitive information.

Industry experts recommend a minimum of 128-bit encryption be used for all secure online sessions. Some Web server-client browser configurations enable sessions with up to 256-bit encryption protection, the strongest level of encryption commercially available today.

The strength of encryption enabled for any session depends on what your customer’s browser and operating system support, as well as what your host server systems will support. If your consumer’s browser or operating system does not support higher levels of encryption, the session will default down to the highest level that it can support.

Regular 128-256 bit SSL Certificates intended for securing leading sites...

EV SSL Certificate stands for Extended Validation secure socket layer. EV SSL certificate provides highest level of security in the industry. SSL Certificate has become fundamental requirement of today’s e commerce business.

Customers trust Extended Validation SSL Certificate the most. One cannot easily get Extended Validation SSL Certificate. In order to get Extended Validation SSL Certificate, Certificate Authority has to investigate about your organization. You have to submit so many documents for that.

The following entities are eligible provided they are currently registered with and approved by an official registration agency in their jurisdiction.

Government agencies
Corporations
Unincorporated associations
General partnerships
Sole proprietorships

Requirements:-

The organization must be verifiable for getting EV SSL Certificate.

These organizations must have a confirmable physical existence business presence.

Any assumed business names should be verifiable.

A principal individual related with the business must be validated and that person must confirm agreement to the certificate subscriber agreement.

The organization cannot be located in a country where listed on any government prohibited list such trade stoppage restriction.

A legal persuasion letter may be required to assure that the requestor has the right to g...

SSL – Secure Socket Layer is a security Protocol. SSL Certificate is a digital signature. SSL Certificate is also known as Public Key Identity certificate. SSL is a protocol for securing communication between a web browser, and web server. Whenever you access a web server using https, the page you are sent is encrypted, and any information you send to that server is also encrypted

Install Root CA Certificate

1) Download your SSL Certificates from SSL Certificate Authorities like RapidSSL, Thawte, GeoTrust or VeriSign.

2) Use the Primary and Secondary Intermediate CA contents into a text file. (Use a text editor - Notepad or Vi.)

3) Primary Intermediate CA (file name as primary_inter.cer)

4) Use the below control to import this Certificate in the keystore:

keytool -import -trustcacerts -alias primaryIntermediate -keystore (your_keystore_filename) -file primary_inter.cer

5) For the Secondary Intermediate CA, (file name as secondary_inter.cer)

6) Use the below control to import this Certificate in the keystore:

keytool -import -trustcacerts -alias primaryIntermediate -keystore (your_keystore_filename) -file primary_inter.cer

Install the SSL Certificate

SSL CA email your Certificate. Use an attachment file(Cert.cer). Copy and paste it into a text file.
Use the below control to import your SSL Certificate:

keytool -imp...