SSL - Is it secure? Yes, it is.

Often times people told me that SSL is a secure communication protocol. They thought about it in to ways, 1) all my data are encrypted and no hacker can get it, 2) the server knows who I am, so I am authenticated. Stop - wait a minute. First of all, SSL is a secure way to communicate. Secure from a point A to a point B. If SSL is used to secure HTTP connections then is A your Internet Browser and B is the HTTP daemon on the other end's web server. So it is not encrypted what your are typing in, and the data store on B is also not encrypted, at least not be the SSL communication. Okay, back to the communication between A and B. You know only the identity of the server, but how? Your DNS Server is directing you to the correct IP address and an official internet authority (e.g. GlobalSign) has issued a SSL server certificate for the server after checking certain criterias, which should proof the identity of the organization which is running the server. As far as you are using a trustworthy DNS, the internet authority did it job, noone has installed a "odd" Root CA into your browser and you are not getting SSL error message during you open the web site, the SSL connection is secure.
But still on the web server could an administrator or hacker copy data, or someone thinks she can sell your address data. So check at least the privacy statement on the website. Is something wrong, error on SSL connect or the privacy statement sounds wear, dont type in any personal information.

How to plan a CLM deployment

To deploy the Certificate Lifecycle Manager (CLM)sucessfully it will need maybe more time for preperation then for other applications. CLM 2007 has impacts on Windows 2003 Enterprise Edition, SQL Server 2005, your Active Directory strategy, IIS, Security Policies, Certificate Services and so on. Probably in larger organizations you have to talk to more then one other guy. :-)

My spreadsheet hopefuly helps you to start quickly


http://spreadsheets.google.com/pub?key=pUqp6TNO9kzkO4UIAZH-5Zw

Exchange 2003 contacts and certificates

In Exchange you can add externals recipients as contacts. So I tried to add certificates to the contacts, just my Outlook was not able to get them and so I couldn't send a encrypted email.

The standard with S/MIME is first to exchange signed messages between both parties and then they can start to encrypt. Well, that's nice for your home computer, but not the right thing for a huge company were everyone is working on other things instead on PKI stuff ;-).

So I added the user certificates to the contact object with an LDAP browser (e.g. ldp). Make sure that you are uploading DER encoded files and that you have a valid email encryption certificate (Enhanced Key Usage: Secure Email). After that it is working in Outlook and Outlook Web Access.

 

First blog

I will share my daily experiences and challenges here.

Mainly my themes are around X509 PKI, PGP for Mac, Linux and Windows. My focus is how to run a PKI smoothly and with a high user acceptance.