Most people browsing and shopping on the internet are only aware of the SSL protocol when they look for the little padlock at the bottom of the browser window that indicates SSL is in effect for this web page. Many people, however, are not aware of the indicator of the use of Extended Validation SSL: a green bar with the site-name. In both cases, SSL acts transparently with no effort needed on the part of the user to ensure a secure Internet session for the user.
It is true that the secure certificate process has undergone some body blows this past year. Some high-profile security breaches at certificate authorities have resulted in the possibility of wrongly-issued certificates. For example, last fall, GlobalSign, a European certificate authority, had to stop issuing certificates when a breach in the company's security structure was discovered -- it was not until last week that the company reassured its customers by announcing that no "rogue certificates" had been issued because of that breach.
Given the vast array of software that uses these certificates and the millions upon millions of websites that depend on these certificates for economic survival, the development of a comprehensive workable set of technical requirements for digital certificates was a Herculean task. These new international standards, the first of their kind for these security protocols, define the requirements by which CAs issue and manage these publicly-trusted digital certificates. Developed over the last few years with input from over fifty Internet-related companies, including browser creators and developers, existing Internet standards groups and the world's CAs, these baseline standards are touted to improve the accountability and reliability of the issuance process for all SSL and TLS certificates.
These new standards, though only voluntary, are slated to become part of the production process for digital certificates on July 1, 2012, but enforcement will depend on the adoption of the standard by browser makers. However, the CAs already responsible for the issuance of 94% of all issued certificates have pledged to adoption of the guidelines, which include the definition of such best practices as verification of identity, establishing the content of the certificates, revocation procedures, audit requirements, key sizes, use of algorithms and confidentiality, privacy and liability issues.
The complete document, a 32-page PDF file, is available at the CA/Browser Forum website.
