VeriSign Confirms All SSL and EV SSL Certificates Remain Safe From Potential Threats Newly Presented at Black Hat Conference

August 2, 2009 by  

Web Hosting ToolsLAS VEGAS, NV – Black Hat® USA 2009 Conference – As researchers unveiled a series of potential threats to Secure Sockets Layer (SSL) Certificates at Black Hat USA 2009, VeriSign, Inc. (NASDAQ: VRSN) today reassured its millions of SSL customers that all SSL Certificates from VeriSign, including its VeriSign® GeoTrust®, thawte® and RapidSSL® brands, are safe from the threats outlined this week.

SSL and Extended Validation (EV) SSL Certificates from VeriSign and its brands are not susceptible to two new SSL vulnerabilities described in Black Hat sessions this week:

Null characters threat.
Experts believe hackers may use null characters embedded in some SSL certificates to fool browsers and other pieces of relying software into believing a certificate has been issued to a different domain than the one to which is was actually issued. However, none of VeriSign’s SSL Certificates of any brand are issued with null characters in the common name (CN), so VeriSign certificates cannot be used in this type of attack. In addition, EV SSL Certificates are an effective defense against null character certificate attacks. This defensive capability applies both to customer-facing and non-customer-facing-systems, such as auto-updating desktop applications.

MD2 vulnerability.
Experts also think certificates that employ Message Digest Algorithm 2 (MD2) may be subject to pre-image attacks later this year, essentially rendering this hash function untrustworthy. Since May 2009, VeriSign and its brands have issued their SSL Certificates using SHA-1, designed by the National Security Agency. Customers with existing VeriSign certificates are not vulnerable to this attack and their certificates do not need to be replaced.

“It’s natural to be concerned when security experts uncover vulnerabilities that can open an organization and its customers to attack, but site operators can rest assured that SSL Certificates from VeriSign cannot be used as part of the SSL threats revealed this week,” said Tim Callan, vice president of product marketing at VeriSign. “Until client software vendors can fix these vulnerabilities in their applications and operating systems, solutions like VeriSign EV SSL provide effective and reliable protection against these potential threats.”

About VeriSign
VeriSign, Inc. (NASDAQ: VRSN) is the trusted provider of Internet infrastructure services for the networked world. Billions of times each day, VeriSign helps companies and consumers all over the world engage in communications and commerce with confidence.

Want to receive alerts when your website is down? Sign-up for free website monitoring at

Be Sociable, Share!


Comments are closed.