SSL digital certificate facts from thawte

		The=20 Facts About SSL

	The = Facts About=20 SSL

[=20 Fran=C3=A7ais ][=20 Deutsch ][= =20 Espa=C3=B1ol ]

There are many Certification = Authorities=20 (CAs) currently offering digital certificates, = each with=20 various certificate products. For the first time = user of=20 digital certificates it is often difficult to = make an=20 informed purchase decision. Equally, experienced = users=20 may not have a full understanding of certain = finer=20 points relating to the products that are = available on=20 the market.

We aim to provide impartial advice = on how=20 to approach the purchase of SSL certificates = while at=20 the same time clarifying certain issues relating = to the=20 product and industry which are often = misunderstood. Our=20 hope is that you find the information provided = of=20 assistance in making the right purchase for your = business and security needs.

1. When do you need to use = a=20 digital certificate?

Securing transmission of financial = information in ecommerce is currently the major=20 application of SSL certificates. However, with = incidence=20 of identity theft on the rise, protection of = personally=20 identifiable information is becoming ever more=20 important. This category of data would include = identity=20 and social security numbers, as well as e-mail=20 addresses.

So, if you are handling financial=20 transactions on your web site, there is no = question that=20 SSL certificates are required. If you are = managing=20 sensitive customer data, the use of SSL = certificates is=20 worth serious consideration =E2=80=93 especially = if=20 customer/member security and privacy is high on = your=20 list of priorities.

2. Why use a digital=20 certificate?

There are two main reasons why you = should=20 make use of a digital certificate:

1. To prove your company's (or = your=20 server's) identity online and in so doing create = a sense=20 of trust and confidence in using your web = site.

2. To offer protection of the data = submitted to your web site (or between servers) = through=20 the use of encryption. Should any information be = intercepted, it will be unintelligible without = the=20 unique key used for decryption.

When evaluating a certificate = product,=20 make sure it delivers on each of these=20 requirements.

3. What level of = authentication=20 does the certificate offer?

In securing your web site with a = digital=20 certificate, your main aim is to provide proof = of your=20 online identity and in so doing establish a = relationship=20 of trust with those with whom you wish to = interact=20 online. This is where authentication comes into = play as=20 the most important element of a digital=20 certificate.

Authentication provides users with = proof=20 that:

1. your company is a bona fide = real world=20 company.

2. they are connecting to the = correct=20 server

A certificate's level of = authentication=20 may be seen as an indication of its quality = =E2=80=93 the higher=20 the level of authentication provided, the = greater the=20 quality of the certificate. It is therefore = important to=20 understand that the various digital certificates = available each differ in level of authentication = depending on the issuing CA or even the specific = product.

Some CAs perform only very basic=20 authentication prior to issuing a certificate = while=20 others conduct extensive checks to ensure the = identity=20 of the applying organization. The following are = the=20 various authentication checks that are performed = by=20 CAs:

Domain lookup to confirm that applying = company=20 owns domain.

Check existence of company to confirm that = it is a=20 legally registered organization.

Verification of identity of individual = requesting=20 certificate to confirm that they are an = authorized=20 representative.

All CAs performs one or more of = these=20 authentication checks. The result is a range of = products=20 of greatly differing levels of quality. It is = important=20 to note that the more authentication checks = performed=20 the better the quality of the certificate. So = make sure=20 you determine exactly what authentication checks = are=20 performed before purchasing.

4. What does it mean to be = WebTrust compliant?

A number of CAs have achieved = WebTrust=20 compliance mainly as it is now a Microsoft = requirement=20 that a CA complete a WebTrust for Certification=20 Authorities audit, in order to have their root=20 certificates included in Windows XP / Internet = Explorer.=20 But it is important to understand exactly what = this=20 certification implies. WebTrust does not set = standards=20 for CAs, nor does it monitor or regulate any = existing=20 standards.

WebTrust compliance tells you = nothing=20 about the quality of the authentication on offer = =E2=80=93 it=20 merely confirms that the CA in question adheres = to their=20 own stated policies and procedures for = authentication.=20 What this means is that WebTrust compliance=20 unfortunately does not provide a useful basis = for=20 comparison between CAs.

5. What is the strength of = a=20 certificate? (what is SGC = technology)

The encryption strength of a = digital=20 certificate is determined by the level of = encryption=20 supported by the browser used to connect to a = web site=20 and the server where the web site resides. This = means=20 that users may connect at 40-bit, 56-bit or = 128-bit=20 depending on the browser version they are = using.

Most digital certificates function = in this=20 way =E2=80=93 providing encryption at a strength = supported by=20 the browser and server. It is important to = understand=20 this distinction as many CAs promote their = certificates=20 as 128-bit when in fact they will support = sessions of=20 varying encryption strength (128-bit being the = strongest=20 possible level of encryption).

In the past, legislation of the = United=20 States government prevented the export of = 128-bit=20 encryption technology. The result of this was = the=20 creation of the so called = =E2=80=9Cexport=E2=80=9D browser versions=20 which were restricted to 40-bit and 56-bit = encryption=20 capabilities. These browsers were distributed = outside of=20 the United States for many years and were even=20 downloaded by US based users. In 1997, the US = government=20 repealed its ban on 128-bit encryption. Today = however,=20 there are still significant numbers of export = version=20 browsers in use, mainly internationally but also = in the=20 United States.

Digital certificates have been = developed=20 that provide 128-bit encryption for browsers = which are=20 defaulted to 40-bit or 56-bit encryption = =E2=80=93 the so called=20 =E2=80=9Cexport=E2=80=9D browser versions which = include IE 5.01 and=20 Netscape 4.7x and later . These certificates = include=20 technology known as Server Gated Cryptography = (SGC)=20 which automatically steps-up these browsers to = the=20 128-bit encryption level. Only a handful of CAs = supply=20 these certificates, so if you require the = 128-bit=20 encryption step-up capability, make sure you ask = for SGC=20 technology

6. How can you benefit = from=20 SGC-enabled SSL certificates?

With thawte's SGC SuperCert=20 certificates e-commerce companies can provide = increased=20 security for both their customers and = themselves. In=20 doing so companies using SGC will improve their = brand=20 security, thereby building trust with their=20 customers.

Tests conducted by the Yankee Group have = shown that=20 millions of internet users still use older = versions of=20 Windows 2000 (without Service Pack 4 or the=20 high-encryption pack), which results in millions = of=20 internet users connecting to SSL enabled sites = with=20 weak, vulnerable 40 and 56-bit encryption rates, = placing=20 themselves and many vendors=E2=80=99 brands, at = great risk.=20 These same users can automatically gain = full-strength=20 128-bit encryption, the minimum recommended = level of=20 encryption for financial transactions, when = conducting=20 business with SGC-enabled websites.

According to the Yankee Group, wide-scale = deployment=20 of SGC-enabled SSL certificates, such as = thawte=E2=80=99s SGC=20 SuperCert, would reduce the actual number of = users=20 exposed by weaker encryption dramatically and = make it=20 possible for virtually every internet user to=20 automatically be stepped up to 128-bit.

256-bit encryption can be achieved if the = user's=20 browser capability and the cipher suite = installed on the=20 web server are both 256-bit = compatible.

7. What is the product for = you?

There are various factors which = will=20 influence your choice of digital = certificate.

Firstly, you need to consider the=20 sensitivity of data that is to be secured. It = makes=20 sense that highly confidential personal and = financial as=20 well as critical business information demand the = highest=20 levels of authentication and encryption. = Alternatively,=20 some may argue that there are other applications = that do=20 not require these stringent security measures. = The=20 bottom line is that you need to categorize the = various=20 types of data you manage according to their = importance=20 to your business and select a digital = certificate for=20 the task at hand.

In certain countries there is now=20 legislation which governs the level of = encryption=20 required for data protection. This type of = legislation=20 is normally developed for data intensive = industries=20 where security and privacy is a major concern = such as=20 financial services or health care. Typically, = companies=20 are required to guarantee that they protect data = with=20 128-bit encryption =E2=80=93 a requirement which = determines the=20 use of a specific type of digital certificate. = In this=20 case digital certificates which are able to = step-up to=20 128-bit encryption are the product of = choice.

Geographic location of your = customer/user=20 base is also an important consideration. The = reason for=20 this is that certain older browser versions = which still=20 exist in significant numbers internationally do = not=20 automatically support 128-bit encryption, only = 40-bit=20 and 56-bit. Typically, these are the so-called = =E2=80=9Cexport=E2=80=9D=20 browsers which where made available outside of = the=20 United States for many years. It is also worth = noting=20 that users in the United States have also = downloaded=20 these export browsers from non-US websites. So, = if you=20 are conducting business online outside of the US = and=20 128-bit encryption is important to you, step-up = SGC=20 technology is essential.

Lastly, it is worthwhile = considering the=20 duration of the project in question. Most = certificates=20 are available in one or two-year versions (or = longer).=20 If your project is planned for a longer = duration, it=20 makes sense to consider the two-year certificate = option=20 as this not only allows you to benefit from the = cost=20 savings frequently offered on these products, = but also=20 provides the added benefit of increasing = convenience by=20 reducing the frequency of engineering and admin = work=20 associated with installation during certificate=20 renewal.

8. Can you get the after = sales=20 technical support you need?

Depending on your level of = experience in=20 working with digital certificates, you may = require=20 assistance at various stages throughout the life = cycle=20 of the product, from the initial request for a=20 certificate to installation, renewal and = possible=20 re-issuance of a certificate if = required.

Be sure to assess the support = capabilities=20 of the CAs you consider. Try to look beyond the = initial=20 sales process as it is the more unforeseen = circumstances=20 such as server migration where competent support = is=20 always the most valuable.

9. What is the = track-record of the=20 CA?

In business it is always sensible = to=20 purchase from proven, established vendors = =E2=80=93 even more so=20 in today's high tech industry. This is = especially=20 important when purchasing security products such = as=20 digital certificates where using a trusted CA is = essential for doing effective business = online.

The CAs track record may provide = you with=20 some answers to other questions discussed here. = For=20 instance, the longer a CA has been in business, = the more=20 experienced and better developed their support=20 infrastructure is likely to be.

10. Are you dealing with a = root=20 CA?

There are two types of CAs = =E2=80=93 Root CAs and=20 Chained CAs. Root CAs have the roots for their=20 certificates installed in the major browsers, = while=20 Chained CAs issue their certificates off a Root = CAs=20 root.

The reason for the existence of = Chained=20 CAs relates to the issue of certificate = compatibility=20 with the various browser types and versions = currently=20 used. CAs which have been in existence for = longer period=20 of time have been able to include their roots in = each=20 browser type and version that has been released = over the=20 years. Subsequently, their certificate-browser=20 compatibility is extremely high. Newer CAs are = not able=20 to achieve this level of compatibility as they = are only=20 able to include their roots in recent browser = releases=20 and the only way for them to obtain the desired = level of=20 compatibility is to issue certificates signed = with the=20 root of a CA which already has the desired level = of=20 compatibility (this is known as = =E2=80=9CChaining=E2=80=9D).

The main drawback of using a = Chained CAs=20 is that they do not own, and therefore, do not = control=20 the root used to issue their certificates. From = a=20 certificate customers' perspective this may lead = to=20 potential problems as their certificates are = vulnerable=20 and may be rendered invalid should the terms of = the=20 chaining agreement break down or be affected by = a change=20 in ownership of the root.