Businesses need to migrate to SHA-2 now, including steps such as inventory assessment, policies, application and system testing, and automation.
SHA-1 was deprecated by NIST from 2011 through 2013 because of its security strength being susceptible to a collision attack. Due to ever increasing computational power, the risk of SHA-1 being broken via a collision attack in the next few years is very real. For that reason, most certificate authorities (CAs) only issue certificates using SHA-2 or above.
Google, Microsoft, and Mozilla have already started taking steps last year to aid end users in understanding the risks and have updated their policies. These policies state that sites with end-entity certificates expiring on or after 1 January 2017 that make use of SHA-1 will no longer be accepted as secure. These policies also require CAs to stop issuing new SHA-1 certificates after 1 January 2016.
More What's needed for SHA-1 migration? Download the SHA-1 Migration Guide.
It’s now well known that certificates signed with SHA-1 are not secure, but what progress are companies really making in transitioning to SHA-2? Using Venafi TrustNet certificate reputation services, I generated a report of all SHA-1 certificates that have been issued since 31 December 2013—this date is after NIST had deprecated SHA-1 usage—and filtered out any certificates that are set to expire before the 1 January 2017 deadline. The results speak for themselves as to the state of the industry!
There are over 1.5 million certificates that have been issued since 31 December 2013 with SHA-1 that are set to expire well beyond the 1 January 2017 deadline, when major browsers will stop trusting these certificates.
Although too small a percentage to show on the chart above, 330 certificates were found to be expiring in more than 100 years! I guess some security practitioners are looking out for future generations so that they don’t run into any outages related to certificate expirations, they obviously don’t believe SHA-1 will be fully exploitable by 2114—but this is at the cost of security.
Certificate inventory assessment is the first step, establishing the scope and extent of your SHA-1 to SHA-2 migration. With a clear understanding of your certificate inventory and trust stores, you can determine which systems and applications may be impacted.
Revision of policies is needed to indicate that only SHA-2 certificates are generated moving forward and newly generated keys and certificates are in compliance with corporate and industry security standards.
Application and system testing is one of the very first things that needs to be performed before attempting to deploy any new certificates into the environment. You may have a legacy application that does not support SHA-2 and there is no migration plan from the vendor. If this is the case, you need to make a judgment call: migrate the application to a newer application that does support SHA-2 or live with the risk knowing full well that it’s a ticking time bomb.
Automated deployment of new certificates is recommended, especially when you consider that the average large enterprise has over 23,000 keys and certificates to manage. By automating the process you can validate the entire CA and certificate refresh process, including SHA-2 implementation.
Another recommendation is to deploy a new PKI hierarchy for SHA-2 and slowly migrate all systems and applications from the old one. In doing so, any system or application that does not support SHA-2 can be left using the old PKI hierarchy while all those that do support SHA-2 can use the new, more secure PKI environment.
Where are you in your SHA-1 to SHA-2 migration? Please share any roadblocks or successes you’re experiencing.
Lorem ipsum dolor sit amet, consectetur elit.
Thank you for subscription
Scroll to the bottom to accept
VENAFI CLOUD SERVICE
*** IMPORTANT ***
PLEASE READ CAREFULLY BEFORE CONTINUING WITH REGISTRATION AND/OR ACTIVATION OF THE VENAFI CLOUD SERVICE (“SERVICE”).
This is a legal agreement between the end user (“You”) and Venafi, Inc. ("Venafi" or “our”). BY ACCEPTING THIS AGREEMENT, EITHER BY CLICKING A BOX INDICATING YOUR ACCEPTANCE AND/OR ACTIVATING AND USING THE VENAFI CLOUD SERVICE FOR WHICH YOU HAVE REGISTERED, YOU AGREE TO THE TERMS OF THIS AGREEMENT. IF YOU ARE ENTERING INTO THIS AGREEMENT ON BEHALF OF A COMPANY OR OTHER LEGAL ENTITY, YOU REPRESENT THAT YOU HAVE THE AUTHORITY TO BIND SUCH ENTITY AND ITS AFFILIATES TO THESE TERMS AND CONDITIONS, IN WHICH CASE THE TERMS "YOU" OR "YOUR" SHALL REFER TO SUCH ENTITY AND ITS AFFILIATES. IF YOU DO NOT HAVE SUCH AUTHORITY, OR IF YOU DO NOT AGREE WITH THESE TERMS AND CONDITIONS, YOU MUST NOT ACCEPT THIS AGREEMENT AND MAY NOT USE THE SERVICE.
You shall not access the Service if You are Our competitor or if you are acting as a representative or agent of a competitor, except with Our prior written consent. In addition, You shall not access the Service for purposes of monitoring its availability, performance or functionality, or for any other benchmarking or competitive purposes, and you shall not perform security vulnerability assessments or penetration tests without the express written consent of Venafi.
This Agreement was last updated on April 12, 2017. It is effective between You and Venafi as of the date of Your accepting this Agreement.
The Venafi Cloud Service includes two separate services that are operated by Venafi as software as a service, each of which is separately licensed pursuant to the terms and conditions of this Agreement and each of which is considered a Service under this Agreement: the Venafi Cloud Risk Assessment Service or the Venafi Cloud for DevOps Service. Your right to use either Service is dependent on the Service for which You have registered with Venafi to use.
This License is effective until terminated as set forth herein or the License Term expires and is not otherwise renewed by the parties. Venafi may terminate this Agreement and/or the License at any time with or without written notice to You if You fail to comply with any term or condition of this Agreement or if Venafi ceases to make the Service available to end users. You may terminate this Agreement at any time on written notice to Venafi. Upon any termination or expiration of this Agreement or the License, You agree to cease all use of the Service if the License is not otherwise renewed or reinstated. Upon termination, Venafi may also enforce any rights provided by law. The provisions of this Agreement that protect the proprietary rights of Venafi will continue in force after termination.
This Agreement shall be governed by, and any arbitration hereunder shall apply, the laws of the State of Utah, excluding (a) its conflicts of laws principles; (b) the United Nations Convention on Contracts for the International Sale of Goods; (c) the 1974 Convention on the Limitation Period in the International Sale of Goods; and (d) the Protocol amending the 1974 Convention, done at Vienna April 11, 1980.
In the meantime, please explore more of our solutions
In the meantime, please explore more of our solutions
This site uses cookies to offer you a better experience. If you do not want us to use cookies, please update your browser settings accordingly. Find out more on how we use cookies.