June 2012
- Serving OCSP on a CDN
So last week we moved our revocation repositories behind a CDN, this has a number of great benefits but it does have downsides though, for example.
- Using Monitis to monitor OCSP and CRL performance
Earlier I did a post on the performance of revocation repositories, in that I used the Monitis do some basic bench-marking for repository performance.
- Revocation repositories, IPv6 support, message size, and performance
So the last few weeks I have spent a reasonable amount of time looking at performance and networking related problems associated with revocation repositories. I still have some additional work to do but I figured I would…
- A revised look at the new Windows Update SSL configuration
The other day I did a quick post about how SSL was configure for Windows Update, I thought I would double back and see if they have made any changes and it looks like they have.
- Setting HTTP headers with OpenSSL and the OCSP test client
So I have been doing some OCSP performance bench-marking the last few weeks, one of the things we noticed while doing this is that OpenSSL does not set the HOST header when sending requests.
- Measuring OCSP Responder Performance with Powershell
The other day I did a post about testing if OCSP stapling was working, but what about telling how fast your OCSP responder is?
- Pulse data publicly availible
SSL Pulse is an initiative ran by Qualys to monitor the overall health of the SSL deployments on the Internet. It is based on the SSLLABS work Ivan Ristik has done; he has recently published the data used to derive these…
- A look at the new Windows Update SSL certificates
This morning I noticed a tweet by Mikko about the Windows Update certificate chain looking odd so I decided to take a look myself.
- What is your organizations policy on SSL?
In other posts I discussed how to redirect the initial request to a website from the HTTP version to the HTTPS (for Apache and IIS).
- Redirecting HTTP to HTTPS in IIS
So you have been using SSL on your IIS 7.5 or greater server for some time now; to get here you had to do a few things:
- Redirecting HTTP to HTTPS in Apache
So you have been using SSL on your Apache website for some time now; to get here you had to do a few things:
- Was the Flame WSUS attack caused just because of the use of MD5?
This morning I saw a number of posts on Twitter about Flame and the attacks use of a collision attack against MD5.
- RSA keys under 1024 bits and you
Recently Microsoft announced that they will push an update in August that will prevent the use of RSA keys with a bit-length less than 1024.
- Testing OCSP Stapling
So you have configured OCSP stapling and you want know if it’s actually working, it’s easy enough to check using the openssl sclient command:
- OCSP Stapling in IIS
Windows Server 2008 and later support a feature called OCSP stapling. When enabled a server pre-fetches the OCSP response for its own certificate and delivers it to the user’s browser during the TLS handshake. This…
- OCSP Stapling in Apache
Apache 2.3 and later support a feature called OCSP stapling. When enabled a server pre-fetches the OCSP response for its own certificate and delivers it to the user’s browser during the TLS handshake. This approach…
- Flame and Certificate Revocation
Microsoft has published patches that insert the CAs directly associated with the Terminal Services Licensing PKI into the “Untrusted” certificate store, this has the same effect as revoking the certificates for those…
- Flame was just one use of the Terminal Services Licensing PKI
I wanted to do a post on how the Terminal Services Licensing PKI could be used in another attack; though the variants are endless I have one concrete example of how this was used in in an attack in 2002 in this…
- How did the Terminal Services Licensing PKI effect you?
The other day I did a post on the age of the Microsoft PKI that was used for Terminal Services Licensing, today I thought I would talk about what that age meant in the context of the vulnerabilities it introduced.
- How one typically verifies code comes from Microsoft
Microsoft signs all code that ships from it (that is except for the case when it doesn't); so how does one verify that the code came from them vs. anyone with a fraudulent certificate claiming to be them?
- The tale of two (Microsoft) PKIs
As you know I used to work at Microsoft on areas surrounding cryptography, certificates, protocols and other such things.
- MSRC 2718704 and the age of the rogue certificates
One of the things I love about security is how security researchers are so passionate about their jobs; they for the most part respect their peers and enjoy learning about attacks so they are willing to share…
- MSRC 2718704 and Terminal Services License Certificates
When looking at the certificates the Flame authors used to sign the malware in their Windows Update module one has to wonder what was different between a normal terminal services license certificate and the one they…
- MSRC 2718704 and Nested EKU enforcement
There are a number of technical constraints a Certificate Authority can put into place on a subordinate Certificate Authority; the general concept is referred to as Qualified Subordination.
- MSRC 2718704 and the Terminal Services Licensing Protocol
There has been a ton of chatter on the internet the last few days about this MSRC incident; it is an example of so many things gone wrong it’s just not funny anymore.