Lead Image © Bruce Rolff, 123RF.com

Securing the TLS ecosystem with Certificate Transparency

A Curse and a Blessing

Article from ADMIN 60/2020

By Matthias Wübbeling

With the need for home offices during the pandemic lockdown, provisional solutions instituted on the fly during the transition from office to home require more permanent solutions, especially for securing TLS connections on the Internet.

Certificate Transparency further secures the TLS ecosystem on the Internet by identifying unauthorized certificates. This transparency, however, offers attackers an opportunity to search for services (e.g., video conferencing systems) that are unprotected on the network. Administrators need to be aware that, thanks to Certificate Transparency, supposedly confidential domains or subdomains are published as soon as a certificate is issued for them.

The preventive measures that were implemented this year to protect people against COVID-19 have unexpectedly turned IT landscapes in many countries upside down. All of a sudden, home offices that had previously not been allowed in corporations were now necessary. In view of the lack of alternatives, many managers and IT departments had to establish new processes quickly and expand existing infrastructures. In the heat of the moment, many new services were set up, initially to test the possibilities.

Many of the new installations were in the area of tele- and video conferencing systems and have remained in operation as permanent provisional solutions – secured with a Let's Encrypt certificate, but without any further protection and often even usable without a login. Because the service was not linked to anything and was only used internally, many administrators – for reasons of ease of use and because they had many other urgent tasks – decided not to change this state by, for example, securing the services in a sensible way during the transition.

Identifying Spoofed Certificates

Recent years have seen a great deal of flux in the TLS certificate ecosystem. The Let's Encrypt service revolutionized the entire certificate market in 2014. Without too much setup overhead and without any costs, administrators can use this service to secure the communication of their web services. According to the Censys website

...

Use Express-Checkout link below to read the full article (PDF).