Target.com Blocked, SSL Certs Blamed
Written by Evan SchumanOn Wednesday (July 21), Target.com’s gift-card site started the day virtually off-limits to its customers, courtesy of a “This Connection is Untrusted” warning due to an expired security certificate. Target may be the most recent example of retailers inadvertently letting their certificates expire, but it’s far from alone. Such lapses are becoming an almost weekly E-tail occurrence.
The problem is easy enough to fall into, which is the real issue. The nature of the certificates forces them to have strict expiration dates, which means that a 2- or 3-year-old certificate is likely to expire on the watch of someone other than the person who initially arranged for it.
If certificates allowed auto-renewal, it would defeat their purpose, which is to assure that there really is someone at home and that someone is who he or she claims to be. What if a chain abandoned a particular site and no one thought to cancel the certificate? It would be continually renewed, even though the trusted retailer was no longer involved. What if cyberthieves then took over that abandoned site and tried to live large off of that retailer’s credibility and reputation?
It’s the same thinking behind a one-year limit on prescription renewals, even for patients who are placed on drugs for life. The intent is to force the patient to see a doctor, to hopefully identify something that would otherwise go undetected.
That said, there should be blatant techniques to make sure a retailer’s team knows when a certificate is about to expire and, almost as important, gets an extremely loud message when the certificate has actually expired.
That sure beats letting customers see what Target’s visitors saw on Wednesday: “This Connection is Untrusted. You have asked (insert browser name) to connect securely to redcard.target.com, but we can’t confirm that your connection is secure. Normally, when you try to connect securely, sites will present trusted identification to prove that you are going to the right place. However, this site’s identity can’t be verified.”
What makes the Target situation interesting is not that it allowed the certificate to expire–a fairly common happening–but that the chain was apparently unaware of it when contacted Wednesday morning by media. The problem was fixed a short time later.
Representatives of Target did not respond to requests for comment, nor did representatives of Verizon Business, which owns Cybertrust, the firm that handles Target’s certificates.
Most of the certificates today come from a handful of certification authorities. As of January 2009, Verisign, GoDaddy and Comodo had a combined 86 percent of the market, according to Netcraft Ltd.
Tim Callan, the VP for product marketing at Verisign, said his firm tries to alert retailers of imminent expirations in a few different ways.
-Marc
July 22nd, 2010 at 4:02 pm
Which is why you want a PKI/Cert management group that “owns” all certs, and not leave it in the hands of various developers and business units. This helps keep an institutional memory and implement a central work flow to kick-off the internal renewal process.
July 28th, 2010 at 4:52 pm
One simple best-practice for this type of thing is for eCommerce organizations to create general mail-boxes where these types of alerts and messages can go to, with multiple resources assigned to receive and monitor them. For example: alert@retailer.com. Then there needs to be some processes in place to ensure that access to those mailboxes are transitioned along with a catalog of the certificates, subscriptions, and contracts the business is working with, including what they are for. Having joint NOC and business management monitoring of these mailboxes can help avoid the problem of a person leaving or changing roles and the ball being dropped. The certificate vendors can also mature their processes to stop requiring an individual at the client to “own” the responsibility and be the contact for the certificate, which also contributes to the problem. And finally, there is likely occasions where people get these alerts and either think they are spam or don’t really understand them, thereby not addressing them when they should. Education can help alleviate that, but many eCommerce organizations have grown and evolved a lot over the last few years with little time spent on maturing these aspects given other priorities.