Public Key Infrastructure (PKI) is the glue that holds the internet together. As the internet has developed into a multi-faceted ecosystem with every single ‘thing’ now considered an internet-connected endpoint, PKI has also had to develop quickly in order to meet the demands of the market.
Back in the early 2000s, there weren’t many regulations out there. You could say it was the Wild West for PKI. Certificate Authorities (CAs) didn’t have any standards to adhere to. Some were issuing certificates that lasted for 10 years!
As frustrations grew from within the CA community, a group of like-minded individuals, including Steve Roylance and Melih Abdulhayoğlu, came together with similar employees from the browser community to form the CA/Browser Forum. The CA/B Forum, created in 2005, began governing the issuance of Digital Certificates with the aim to standardize the industry and minimize mis-issuance. They did this by creating a number of bylaws and baseline requirements for certificate issuance and management.
The internet has exploded since the early days of the CA/B Forum. We now have fridges and children’s toys using an internet connection. We also have an influx of black hat hackers forming groups that conduct cybercriminal activities, such as cyber-warfare, phishing, and more.
Today, our infrastructure is still coming up against its own challenges but fortunately, there are a wealth of amazing internet security researchers who are working together and helping the CA/B Forum develop ideas to bring forward new bylaws and baseline requirements that will keep PKI in line with current technology.
Here’s what we have to look forward to in the next 12 months.
Services Will Adopt PKI to Comply
Let’s Encrypt and Google have paved the way for ‘HTTPS Everywhere.’ If you can get a free DV SSL Certificate, there really isn’t an excuse for (Read more...)
This is a Security Bloggers Network syndicated blog post authored by Tripwire Guest Authors. Read the original post at: The State of Security