Software Engineering Institute

Digital certificates are small documents used to authenticate and encrypt information transmitted over the Internet. One very common use of digital certificates is to secure electronic commerce transactions through SSL (Secure Socket Layer). The kind of certificates used in e-commerce transactions are called X.509 certificates. The X.509 certificates help a web browser and the user ensure that sensitive information transmitted over the Internet is readable only by the intended recipient. This requires verifying the recipient's identity and encrypting data so that only the recipient can decrypt it.

The "padlock" icon used by Internet Explorer (as well as Netscape and other browsers) is an indication that an SSL-secured transaction has been established to someone. It does not necessarily indicate to whom the connection has been established. Internet Explorer (and other browsers) take steps to warn users when DNS-based information conflicts with the strongly authenticated information contained in the X.509 certificates used in SSL transactions. These warnings are supplemental information to help users decide if they're connecting to whom they think they are connecting. These steps and warnings are designed to protect against attacks on the DNS information.

When IE is configured to automatically check a certificate revocation list (CRL) for revoked certificates, it fails to perform other checks to ensure that the certificate is valid. These checks include

• checking to ensure the Certificate Authority (CA) that signed the certificate is trusted
• checking the data on the certificate to ensure it has not expired
• checking that the server name matches the name on the certificate

Attackers may be able to mislead people into exposing confidential information that the victim intends to provide to a trusted site.

Apply a patch as described in MS-01-027.