So it's been noted in a few places that 2017 is the year that SHA1 for HTTPS is doomed. Microsoft has deprecated SHA1 in Edge and Internet Explorer browsers and in February 2017 will be blocking them entirely. Google is doing the same thing with Chrome starting January 2017, as …

Python 2.7.9 was released nearly a month ago and with it came some SSL-related changes (it backported the Python 3.4 ssl module and does HTTPS certificate validation using the system's certificate store). The latter can cause some problems with home-grown CA's, however. On Mac OS X, the …

I've refrained from posting or saying anything about Heartbleed all week because I didn't want to add to any sensationalism and hype, and I've also been too busy actually dealing with it (as opposed to simply talking about it or running around with hands waving in the air like a …

This week's mac techmail is Create your own SSL CA with the OS X Keychain. This talks about how you can use the Certificate Assistant on OS X, to create your own SSL Certificate Authority for a local network or internal organization. The tool is quite slick, if a little …

This week's mac techmail is Managing SSL Certificate Authorities on OS X which takes you through adding a CA to the OS X keychain to verify SSL certificates. This is mostly useful for internal networks that use their own CA and it (obviously) doesn't come bundled with any OS. This …

This week's TechMail is Configure Apache to support multiple SSL sites on a single IP address which talks about the new SNI (Server Name Indication) feature in Apache 2.2.12. This is a really welcome feature as previously if you wanted more than one SSL-secured site, you needed more …

The Register has just put up an article entitled After Debian releases SSL patch, a world of hurt for security pros. On page 2, I'm quoted which is cool, but what isn't cool is that the two typos in the article happen in my "quotes". Strange thing is that it …

In light of the recent Debian debacle and to get the word out to more people, this week's Techmail is Find and fix weak OpenSSL/OpenSSH keys: Debian-based Linux vulnerability which more or less reiterates what happened with the Debian OpenSSL... fun... and points to the dowkd.pl script that …

It's been an amusing morning reading more takes on the Debian OpenSSL issue. While I was in the know before most others due to vendor-sec, and was able to quickly verify this didn't affect Mandriva, the fallout still continues. For those that think otherwise, this is a big issue, and …

Found this interesting comic today.. Fred linked to it in IRC and I just had to share.