Tag: Mozilla Firefox

Starting with version 58, Google has decided to remove support for the Subject Distinguished Name of web server certificates in the Chrome browser and instead only accept certificates with Subject Alternative Name.

Since then, web server certificates without a Subject Alternative Name in the form of a dNSName have been rejected by Google Chrome and other Chromium -based browsers (i.e. also Microsoft Edge ). Other browser manufacturers quickly adopted this approach, so that this problem now affects all popular browsers.

Continue reading "How the TameMyCerts Policy Module for Active Directory Certificate Services (ADCS) can repair incoming certificate requests to make them RFC compliant"

When troubleshooting, it can be very helpful to view encrypted SSL connections in order to inspect the messages within. There is a relatively simple way to do this with Wireshark.

Continue reading "Inspect TLS traffic with Wireshark (decrypt HTTPS)"

In the context of hardening measures, it is a good idea to apply the Microsoft Security Baselines published by Microsoft to your own server landscape.

This will inevitably have an impact on PKI components. The following is an overview of the expected effects and countermeasures.

Continue reading "What to consider when applying Microsoft Security Baselines?"

Apple recently announced that the Safari browser will in future only accept certificates with a validity of 398 days, provided they were issued on or after September 1, 2020.

Mozilla and Google want to implement comparable behavior in their browsers. So the question is whether this change will have an impact on internal certification authorities - i.e. whether in future internal SSL certificates will also have to follow these rules, as was the case, for example, with Google's enforcement of RFC 2818 .

Continue reading "Chrome and Safari limit SSL certificates to one year validity"