25 new SSL Certificates from Comodo, GeoTrust & RapidSSL

SSL certificate provider GetSSL.me has expanded their product list with 25 new SSL certificates from Comodo, GeoTrust and RapidSSL. 

To provide the best security for every situation GetSSL.me offer Domain, Business and Extended validation SSL certificates. The variation is between regular, wildcard and even multi-domain certificates.

Prices are low as usual which means that client can save up to 85% off regular price.

See the certificate list yourself on GetSSL homepage.

SSL certificate provider GetSSL.me has announced summer sale

Secure socket layer

An industry standard way to protect your website is by using SSL certificate. 

SSL stands for secure socket layer which protects your website and allows customers to trust your website with their personal information, by encrypting important information during different online transactions.

SSL certificate provider GetSSL.me has announced its summer sale. Now you can  secure your website starting from just $6.95 a year. 

Here are the prices for Standard, Business Validated and Wilcard certificates:

• Standard SSL - $6.95
• Business Validated SSL - $65.95
• Wildcard SSL - $95.95

Promotion is for a limited time only. For more information check GetSSL.me website.

GetSSL.me summer sale

SSL certificate provider GetSSL.me has announced summer sale | GetSSL.me

Jealous of PRISM? Use "Amazon 1 Button" Chrome extension to sniff all HTTPS websites

tldr: Insecure browser addons may leak all your encrypted SSL traffic, exploits included.

So, Snowden let the cat out of the bag. They're listening - the news are so big, that feds are no longer welcome at DEFCON. But let's all be honest - who doesn't like to snoop into other person's secrets? We all know how to set up rogue AP and use ettercap. Setting up your own wall of sheep is trivial. I think we can safely assume - plaintext traffic is dead easy to sniff and modify.

Amazon 1 Button

The real deal though is in the encrypted traffic. In browser's world that means all the juicy stuff is sent over HTTPS. Though intercepting HTTPS connections is possible, we can only do it via:

• hacking the CA
• social engineering (install the certificate) 
• relying on click-through syndrome for SSL warnings

Use "Amazon 1 Button" to sniff all HTTPS websites | Kotowicz Blog

Ruby update fixes SSL man-in-the-middle vulnerability

The OpenSSL implementation bundled with Ruby has been found to be vulnerable to having its hostname check bypassed. 

Ruby update fixes SSL vulnerability

The flaw, rooted in the lack of proper handling of alternate X509 names with null bytes in them, could allow an attacker to present a certificate for "www.ruby-lang.org\0example.com" which when read by the Ruby client library, would be interpreted as "www.ruby-lang.org". That result would be handed over to the certificate verfication routines which would cause the certificate would be identified as coming from "www.ruby-lang.org". If an attacker could get a certificate where thesubjectAltName included such a null byte, they could use that certificate to interpose themselves between a victim and the site.

Ruby update fixes SSL man-in-the-middle vulnerability | The H Security

RFC: Certificate Transparency. Interesting attempt to make CA actions auditable.

IETF

An experimental protocol for publicly logging the existence of Transport Layer Security (TLS) certificates as they are issued or observed, in a manner that allows anyone to audit certificate authority (CA) activity and notice the issuance of suspect certificates as well as to audit the certificate logs themselves. The intent is that eventually clients would refuse to honor certificates that do not appear in a log, effectively forcing CAs to add all issued certificates to the logs.

RFC Document