Target.com Blocked, SSL Certs Blamed
Written by Evan SchumanJuly 21st, 2010
On Wednesday (July 21), Target.com's gift-card site started the day virtually off-limits to its customers, courtesy of a "This Connection is Untrusted" warning due to an expired security certificate. Target may be the most recent example of retailers inadvertently letting their certificates expire, but it's far from alone. Such lapses are becoming an almost weekly E-tail occurrence.
The problem is easy enough to fall into, which is the real issue. The nature of the certificates forces them to have strict expiration dates, which means that a 2- or 3-year-old certificate is likely to expire on the watch of someone other than the person who initially arranged for it.
This Story Is Only Available For Premium Subscribers. Click Or Login In Below To Read The Rest Of This Story.
Already a Subscriber? Login Here
Pages: 1 2
2 Comments | Read Target.com Blocked, SSL Certs Blamed
Leave a Reply
Readers, specifically those who want to comment on a story:
Our Comment SPAM system is getting very aggressive these days and has been blocking legitimate comments. If you post a comment and don't see it appear within 2 hours or so, can you please send a heads-up to customer-service@storefrontbacktalk? Ideally, please include the time you posted the comment. That will allow us to try and hunt for it. Thanks! P.S. We're working on fixing the system, but we don't want to lose any valuable comments in the meantime.
Our Comment SPAM system is getting very aggressive these days and has been blocking legitimate comments. If you post a comment and don't see it appear within 2 hours or so, can you please send a heads-up to customer-service@storefrontbacktalk? Ideally, please include the time you posted the comment. That will allow us to try and hunt for it. Thanks! P.S. We're working on fixing the system, but we don't want to lose any valuable comments in the meantime.
-Ed
July 22nd, 2010 at 4:02 pm
Which is why you want a PKI/Cert management group that “owns” all certs, and not leave it in the hands of various developers and business units. This helps keep an institutional memory and implement a central work flow to kick-off the internal renewal process.
July 28th, 2010 at 4:52 pm
One simple best-practice for this type of thing is for eCommerce organizations to create general mail-boxes where these types of alerts and messages can go to, with multiple resources assigned to receive and monitor them. For example: alert@retailer.com. Then there needs to be some processes in place to ensure that access to those mailboxes are transitioned along with a catalog of the certificates, subscriptions, and contracts the business is working with, including what they are for. Having joint NOC and business management monitoring of these mailboxes can help avoid the problem of a person leaving or changing roles and the ball being dropped. The certificate vendors can also mature their processes to stop requiring an individual at the client to “own” the responsibility and be the contact for the certificate, which also contributes to the problem. And finally, there is likely occasions where people get these alerts and either think they are spam or don’t really understand them, thereby not addressing them when they should. Education can help alleviate that, but many eCommerce organizations have grown and evolved a lot over the last few years with little time spent on maturing these aspects given other priorities.