The TLS Certificate Scare: What It Means for Your Firm

First, What Is TLS?

TLS is the technology behind the padlock in your browser. It does two jobs: it encrypts the connection between you and a website, and it confirms the website really is who it claims to be.

That second job relies on certificates. A small number of trusted organizations, called certificate authorities, vouch for websites by issuing them certificates. Your browser and devices keep a list of which authorities to trust. When you visit your bank or log in to Microsoft 365, your browser checks the certificate before it shows the padlock.

What Happened

In mid-October, researchers found that the signing keys behind several certificates issued by one certificate authority were extremely weak. These keys are supposed to be impossible to guess. These ones could be worked out from public information in under a second.

Whoever holds those keys could, in theory, create certificates that look legitimate for almost any website. That could let an attacker impersonate a real site or quietly read traffic that should be private.

The major browser makers moved quickly and blocked the affected certificates within days. There have been no confirmed reports of the keys being used in an attack so far.

Why It's Still Worth Paying Attention

Browsers update their trust lists automatically and quickly. Many other things don't.

Applications, servers, firewalls, VPNs, printers, phones, payment and vendor integrations, and older business software often keep their own list of trusted certificates. Some update rarely. Some never do without someone stepping in. Until they're updated, they may still trust certificates they shouldn't.

That's why security teams around the world have spent this week updating software and checking the less visible corners of their networks. It also comes in a busy month, when certificate trust has been targeted in other ways too.

What You Need to Do

For everyone

• •Keep your browser, phone and computer up to date, and restart when prompted.
• •Never click past a certificate or security warning in your browser, even if the site looks familiar.
• •Be extra careful with sensitive logins on public Wi-Fi, where interception is easier.

For firm leaders and office managers

• •Make sure business applications are updated, not just browsers and Windows.
• •Ask the vendors of your key systems, such as document management, accounting, payment and building systems, whether they've updated their trusted certificate lists.
• •Don't forget firewalls, VPNs and other network equipment.
• •Confirm your own website and email certificates come from a trusted, unaffected provider. For most firms, they will.

What VSIT Is Doing for Clients

As part of our managed services, VSIT is:

• •Applying browser, operating system and application updates through our regular patching.
• •Reviewing firewalls, VPNs and other managed devices that rely on their own certificate lists.
• •Checking client websites and email services for affected certificates.
• •Following vendor and government guidance as it develops, and contacting clients directly if action is needed on their side.

Common Questions