Early Detection Of Fake SSL Certificates

Trust it or not, but rather as indicated by Google's security group, NIC (India's National Informatics Center) have been issuing corrupt and dodgy SSL certificate. It has come to see there that NIC has issued a few unapproved SSL certificates to different Google domain. This unapproved certificate can be utilized to feign and imagine as genuine Google site on various servers and can put client's data in risk. With the utilization of such dodgy SSL certificate, it is anything but difficult to keep an eye on or tinker with client's scrambled communication.

Required advances were taken by specialists to ensure the client's data. This, as well as India CCA is researching the issue to discover the main driver as it happened before as well.

• Fake Certificate Security Issues

SSL/TLS (Security Socket Layer/Transport Layer Security) encryption systems are seriously hit by this dodgy SSL system, which was utilized to secure https://association. Different issues that have been raised so far are recorded underneath:

• A notice was issued by Microsoft over 'improper issued' SSL certificate which could have brought about a phishing attack.
• Apple likewise got alarmed about the basic SSL flaw in Mac OS and iOS
• Google has cautioned CNNIC, a middle of the road declaration specialist, about the issuing of unapproved digital certificates.

• Certificate Transparency

Google accepts that it is a serious breach of CA system and such incidents indicate that Google’s Certificate Transparency efforts are critical for protecting the security of certificates in the future. Certificate transparency will help in:

• Eliminating security flaws as it will provide an open framework to monitor and audit SSL certificate in near real time.
• Detect fake SSLs.
• Identifying CAs attempt to issue unauthorized SSL certificates
• Pinning public key can specify authorized SSL certificates.
• Issuing authorities as well as can reject fake dodge SSL certificates.

• Google Logging System

Google engineers have thought of logging system that unites CAs (ones that are trusted) and CAs striving to fabricate its generosity. They have figured out how to issue a rundown of these CA's on an open stage and determine those that are never again trusted by browsers. The fundamental mission of this system is to:
• Protect its user from fake and illegally issued SSL certificates
• Provide public record information about the certificates issued for specific domains.

Let's Discuss About SSL Related Server Error And Their Solutions

Browser warnings-are something that everyone comes across at some point. These warnings are generated to prevent users from an unsecured connection. Without appropriate knowledge, the user tends to ignore these warnings. Without wasting time let’s discuss most common SSL related Server Error and possible solutions.

Common SSL Related Server Error 

• Server Data Error: Expired certificates are the main cause of almost all the server data errors. Simple solution for such errors is ‘do not let your SSL certificate expire’. It is possible that you have certificates from different Certificate Authorities (CAs). It might be difficult to keep track of each and every issued certificate. To resolve such issues, all you need is a management platform and inventory tool.

Solution:

• Inventory tool: it will locate all SSL certificates that you have installed and respective CAs who have issued them.
• You can also use APIs and ACME protocol to keep track of installed SSL certificates.

• Server name mismatch error: When Comodo Wildcard SSL certificate is installed, it is important to include all sub-domain names along with host domain. You can include ‘within the scope’ or specific domain name. Remember ‘www’ and ‘non-www’ domain versions are not one of the same things. Wildcard error can arise due to oversight or multiple levels of the domain. For example: If you have installed the certificate for *.mysite.com, there are chances that it may not cover ‘example.shop.mysite.com’.

Solution:

• You have to include both on the certificate or list them under Wildcard SSL certificate.
• Double check host-name while including it in your certificate.

• Server Authority Invalid Error: Major browsers have come up with a list of trusted CA’s. If you want to verify the authenticity of your CA, you can look for their name in this list. Also, check whether the certificates of your website are chained to a root. Along with is also check whether it is listed in the browser’s trust list. TheError can occur due to the use of self-signed certificates or government operated roots. The Government operated roots are not listed in Standard trusted store. Use of such roots can lead to warnings.

Solution:

• Do not use self-signed certificates on the public website
• Ask your employees to ignore warnings only for internal sites (intranet), not for general browsers.
• Some CA’s offer non-public roots designed specifically for internal networks.