Blocked, SSL Certs Blamed

On Wednesday (July 21),'s gift-card site started the day virtually off-limits to its customers, courtesy of a "This Connection is Untrusted" warning due to an expired security certificate. Target may be the most recent example of retailers inadvertently letting their certificates expire, but it's far from alone. Such lapses are becoming an almost weekly E-tail occurrence.

The problem is easy enough to fall into, which is the real issue. The nature of the certificates forces them to have strict expiration dates, which means that a 2- or 3-year-old certificate is likely to expire on the watch of someone other than the person who initially arranged for it.

If certificates allowed auto-renewal, it would defeat their purpose, which is to assure that there really is someone at home and that someone is who he or she claims to be. What if a chain abandoned a particular site and no one thought to cancel the certificate? It would be continually renewed, even though the trusted retailer was no longer involved. What if cyberthieves then took over that abandoned site and tried to live large off of that retailer's credibility and reputation?

It's the same thinking behind a one-year limit on prescription renewals, even for patients who are placed on drugs for life. The intent is to force the patient to see a doctor, to hopefully identify something that would otherwise go undetected.

That said, there should be blatant techniques to make sure a retailer's team knows when a certificate is about to expire and, almost as important, gets an extremely loud message when the certificate has actually expired.

That sure beats letting customers see what Target's visitors saw on Wednesday: "This Connection is Untrusted. You have asked (insert browser name) to connect securely to, but we can't confirm that your connection is secure. Normally, when you try to connect securely, sites will present trusted identification to prove that you are going to the right place. However, this site's identity can't be verified."

What makes the Target situation interesting is not that it allowed the certificate to expire--a fairly common happening--but that the chain was apparently unaware of it when contacted Wednesday morning by media. The problem was fixed a short time later.

Representatives of Target did not respond to requests for comment, nor did representatives of Verizon Business, which owns Cybertrust, the firm that handles Target's certificates.

Most of the certificates today come from a handful of certification authorities. As of January 2009, Verisign, GoDaddy and Comodo had a combined 86 percent of the market, according to Netcraft Ltd.

Tim Callan, the VP for product marketing at Verisign, said his firm tries to alert retailers of imminent expirations in a few different ways. First, customers have a portal where they can control their account. Logging into that portal would display various alert messages, he said. (Although true, a retailer would likely have no reason to log in unless it had already remembered about the renewal need.)

Second, Callan said, E-mail notices are sent 90 days before expiration and then again at 30 days before expiration, and those E-mails become "increasingly frequent as we approach expiration date."

Third, Verisign assigns major accounts "designated salespeople who are supposed to watch these accounts" for these types of expirations. At $400 per year per server per renewal for the typical account, Callan said, the sales force has an incentive to prevent an expiration problem.

Under the "interesting but not too helpful trivia" category, Callan added that the alerts are actually a function of the site visitor's machine, comparing its date/time stamp with when the certificate broadcasts it is to expire. In other words, a visitor running into such a discouraging message could make it go away by turning his calendar back to an earlier month and trying again. Alternatively, consumers could see tons of these messages by simply setting their calendars to the year 2020.

Even though Verizon didn't comment for this story, it's likely that most certificate vendors follow similar procedures. E-mail messages, though, are easy to ignore, especially when they are sent frequently. Imagine an E-Commerce staffer who is overseeing dozens of sites. There needs to be a more rigorous way to avoid these expirations, perhaps incorporating phone calls and in-person visits for major accounts.

Ultimately, though, if someone on the E-Commerce team doesn't spend the 10 minutes to renew--and do so in the very short window when it needs to happen--the site is going to get blocked. Well, "blocked" may be an overstatement, because customers clearly could ignore the warning and proceed. But it's certainly going to discourage quite a lot of prospects.