Q2. What has changed? In October 2010, VeriSign migrated its public root certification authorities from 1024 bit RSA keys to 2048-bit RSA keys.

Transcription

1 The SSL site certificate for will be updated on Wednesday, Oct 30th 2013 at 08:00 BST onwards and this has important implications for TNT business users. Currently our root certificate, against which the site certificate is validated, uses 1024-bit RSA encryption but this level of encryption is being replaced with a new 2048-bit minimum level of encryption. When renewing our site certificate, our certificate authority, VeriSign, will sign the certificate with their new 2048-bit RSA public root certificate. To operate with our 2048-bit site certificate, our end users must similarly be running a 2048-bit root certificate on their browser/client. If your browser/client encryption certificate does not match TNT s root encryption certificate will result in problems and could potentially impact customers using Express Shipper, Express Connect and MyTNT. Example sites and applications affected by this change include; Express Shipper Express Connect MyTNT Q1. How does the new SSL root certificate get provided? This 2048-bit RSA public root certificate is something that the operating system providers, such as Microsoft or Apple, provide as part of their operating system software. The certificates are updated with the regular specific browser updates and operating system service pack updates. Internet Explorer v7 and v8 come with the new certificate as well as Windows Vista and Windows 7. Windows XP running Service Pack 3 also loads the new 2048-bit root certificate. The root certificate can also be downloaded from the web - see Q6 below. Q2. What has changed? In October 2010, VeriSign migrated its public root certification authorities from 1024 bit RSA keys to 2048-bit RSA keys. Q3. Why? This change and the timing is in line with industry best practices that VeriSign follows to ensure the highest level of security. Operating system vendors are also starting to require the use of 2048-bit keys and Microsoft has stipulated new requirements for all certificates that demand all new root certificates must at minimum use 2048-bit RSA keys. Q4. What is the likely TNT Business Impact? As shown above, this change is an internet wide and a global initiative and it is therefore likely that many or most of our customers will have already made the changes necessary to their browser. However, as we saw with our previous update to iconnections, and ci.tnt.com, there are still a minority of TNT customers that have not updated their browser certificate. Because of the wide-spread nature of the initiative, any client machine not updated with the new Verisign root certificate, will experience issues, not only with the TNT web sites, but with any web sites that utilise Verisign SSL certificates to secure data. Q5. How can I determine what root certificate I use? A client machine can be checked by checking the Trusted Root Certification Authorities defined within Internet Explorer or their browser of choice. Please see your specific browser help function or manual for alternative browsers. To check for the presence of the updated root certificate using Internet Explorer:- 1) Launch Internet Explorer and go to Tools\Internet Options\Content\Certificates\Trusted Root Certification Authorities. 2) Scroll through the Trusted Root Certification Authorities list to verify the presence of the 'Verisign Class 3 Public Primary Certification Authority - G5' certificate. Shown below.

2 3) The certificate can be verified by highlighting the certificate and selecting View\Details\Serial number and confirming the serial number value reads as 18 da d1 9e 26 7d e8 bb 4a cd cc 6b 3b 4a. 4) If the certificate does not exist in the Trusted Root Certification Authorities list then it must be installed. This can be undertaken by the update mechanism used within the client environment. Normally the Trusted Root Certification Authorities list would be updated by routine patching of the client OS or browser upgrades. Q6. How can I download the certificate? Please note you may need administrator rights on the local machine before you can successfully install a new certificate. If in doubt, please contact you local support teams for assistance. To download the 'Verisign Class 3 Public Primary Certification Authority - G5' certificate. 1) Follow the link below to access the 'Verisign Class 3 Public Primary Certification Authority - G5' root CA certificate from the Verisign web site. (Note that the certificate is also attached in the - see below). The following screenshots are taken from the Verisign web site, and you should select the highlighted link below.

3 2) The certificate is displayed on the web page in a highlighted box. Copy the certificate including the '----- BEGIN CERTIFICATE-----' and '-----END CERTIFICATE-----' text. 3) Open notepad and paste the certificate into the document. 4) Save the document with a.cer extension. 5) Quit notepad. 6) You now need to install/import the certificate into you system on Microsoft windows machines. To do this you can double click on it and choose the option to Install Certificate (see screenshot below).

4 7) Windows will select the correct certificate store to install the certificate (see below). If however it does not the option for Trusted Root Certificate can be selected.

5 8) After the certificate has been imported / installed you will get a message similar to the one below advising that the certificate import was successful. 9) To check that the certificate has installed correctly you can check by double clicking on the following certif.cer file: