Blogs

Starting on September 1st, SSL/TLS certificates cannot be issued for longer than 13 months (397 days). This change was first announced by Apple, at the CA/Browser Forum Spring Face-to-Face event in Bratislava back in March.  Then last week, at the CA/B Forum’s Summer event (held virtually), Google announced its intention to match Apple’s changes with its own root program.  There is also a browser-driven ballot that seeks to align the industry’s baseline requirements with the new root program changes. That issue is currently being debated by the Forum. We realize there might be a lot to unpack here, so in the interest of providing a little clarity we’re going to cover it in this blog post.  The reason for shorter SSL/TLS certificate lifespans From a high-level, theoretical standpoint there are two primary benefits for shorter-lived certificates: The first is the technical component – longer lifespans means it takes longer to organically roll out updates or changes. A real-world example would be the SHA1-to-SHA2 transition. Unless you’re going to revoke a whole bunch of certificates and force the customer to re-issue, it can take years before all of the old certificates are replaced. In the case of SHA1, it took three. That creates risk.  The other benefit has to do with identity – how long should the information used to validate an identity stay trusted? The longer between validation, the greater the risk. Google has said that in an ideal world domain validation would occur about every six hours.  Before 2015 you could get an SSL/TLS certificate issued for up to five years. That was reduced to three, and then again in 2018 to two. At the end of 2019, a ballot was proposed at the CA/B Forum that would have reduced it to one year – it was voted down soundly by the Certificate Authorities. So, why are certificate still being reduced to one year? The CA/Browser forum is an industry group that meets to vote on a set of baseline requirements for the issuance of trusted digital certificates. What it is not, however, is a governing body. Even though the CAs expressed concerns and reluctance to decrease max validity again, Apple and Google are well within their right to update the policies for their root programs as they see fit.  We understand that we’ve just thrown a whole bunch of industry terms at you, so let’s step back real quick and make sure the previous paragraph makes sense.  Certificate Authorities and browsers have an interdependent relationship. Browsers need to use certificates to make trust determinations about websites and for help securing connections. On the CA side, what good is a public certificate if it’s not trusted by a browser? The way this is all managed is through the root programs. There are four major root programs of note: Microsoft Apple Mozilla Google ( the last two known as Googzilla – lol) Incidentally, you’ll notice those four are also behind the major browsers on both desktop and mobile. In order for a CA to have its certificates trusted by the root programs, and by extension the browsers and OSs that make use of them, it must adhere to that root program’s guidelines. The CA/B Forum is an industry forum that ideally helps to facilitate changes to the root programs (and the ecosystem itself).  But the root programs, which participate as browsers, can still act unilaterally and make changes as they see fit. When this happens, the need for interoperability basically dictates that whatever root program policy has the most stringent standards becomes the new de facto baseline requirement.  That’s how we got here. Now let’s talk about what this means for your website. What shorter SSL/TLS validity means for website owners First things first, this goes into effect September 1, 2020. So, if you’re using a two-year certificate that was issued before September 1, your certificate will stay valid until its original expiration date. You just won’t be able to renew for two years moving forward.  Or to put it another way, you have until the first of September to get two-year certs. After that they will be relegated to the desktop recycling bin of history.  From a bigger-picture standpoint, this might be a good time to start giving consideration to automating more of your certificate lifecycle management functions. Especially for larger organizations managing dozens of publicly-trusted website certificates, but also for organizations using publicly-trusted email certificates, as well as any organization leveraging a private CA or PKI-based electronic signatures. You might also consider moving some certificates from public to private trust, which also helps with management – you could even issue certs with longer validity using that method.  Otherwise, the way things are headed with the root programs continuing to push for shorter validity – organizations are pretty much going to be forced to automate a lot of these things at some point in the future.  Better to explore that now than when your feet are being pressed to the fire.  How GlobalSign will handle one-year certificates In the interest of simplicity – making the process as straightforward as possible – GlobalSign will provide SSL/TLS customers with the maximum validity of 397 days when they order one-year certificates starting on 31 August. This applies to new orders and renewals, to provide maximum validity for our customer’s benefit. You will still want to renew your certificate before it expires, but since we can no longer provide up to 90 additional days to your validity, we recommend you renew within 30 days of expiration.  What about reissuing my certificates? You may wonder what happens when you reissue one of your two-year certificates after this change goes into effect.  Well, we have good news for you!  If you reissue a certificate and lose validity (we’re required to limit validity to 397 days), you can reissue the certificate later – ideally less than 397 days prior to your original cert expire – and recover the lost validity from your first reissue! This works the same

SSL or TLS Certificates allow websites to run smoothly without the threat of hackers stealing identities and other sensitive information. Depending on your needs, there are various options available for website owners: Domain Validation (DV); Organization Validation (OV); and Extended Validation (EV). The Different Types of TLS/SSL Certificates Domain Validated (DV) Certificates During the initial stages of TLS certification, website owners could only opt for OV certificates, which cut out websites, like personal websites, that wanted to have encryption but did not meet the requirements of an OV certificate. Hence, DV certificates regulate an applicant’s use of a certain domain name. These certificates provide a reliable base-level encryption and the process of applying for a DV is automated and can be issued almost immediately. Organization Validation (OV) Certificates OV certificates go through more vetting than DV certificates. The requirements in OV certificates are domain control, the organization name, city, state, and country. OV certificates exhibit both security and value, making them a good option for businesses on a budget. Extended Validation (EV) Certificates Just like OV certificates, EV certificates also require organizational information, but with added public registration information. As expected, EV certificates tend to be pricier than their DV and OV counterparts. But what you get in exchange is heightened website credibility and trustworthiness for having an EV certificate. What TLS/SSL Certificate Does My Website Need? Choosing the suitable certificate can be confusing with the amount of options available. We will go through some common use cases for each certificate. Do note that these use cases are a guide, and opting for a higher level certificate is always an option and will only increase consumer trust. If you own a website that doesn’t collect any user data, such as a blog, portfolio, or a personal website, opting for a DV certificate may be the best choice for you. Since DV certificates meet the requirements for website encryption, for websites that function without gathering sensitive data or customer data, this would suffice. Google has also been recently pushing website owners to switch to HTTPS, opting for such encryption will help your website rank high in Google search. On the other hand, if you work in a corporation, the government, and other entities that require an extra layer of trust and security for your visitors, opting for an OV certificate may be the best option for your website. As data and sensitive information will be passed through the website, such entities often need to provide greater assurance to users. Thus, with the increased level of vetting, OV certificates are a greater symbol of trust and security for just a little bit more coin. Lastly, for large scale corporations and e-commerce websites, EV certificates may be the best option as it has the highest level of vetting and identity verification among the 3 options. EV certificates help your site visitors have the peace of mind to give not only their personal details but also their payment information on your website. This rigorous validation process takes the most time among the three, but it is also the reason why EV certificates provide the most reliability and assurance. GlobalSign offers a cost-effective range of TLS/SSL options—from DV to EV—ensuring your public servers and sites are in line with industry best practices, but also offers options for internal servers and special use cases. You may visit our official website for more details, or check out our free guide to help you get started on learning what TLS can do for your online brand. NOTE:: This article is copyright by GlobalSign  and we are using is for education or information purposes only. Click Here to visit the official store of GlobalSign  in Pakistan