Keystroke purchases all our SSL Certificates from Tucows (OpenSRS), and we thought we'd share this news bulletin with our customers. As you will note in the bulletin below, this does not effect any certificates purchased through their control panel or RWI, which has been the only method we've used for the last 5+ years.




A vulnerability in the design of SSLv3 was uncovered earlier this week. This vulnerability means that attackers could exploit this weakness and try to decrypt encrypted connections. SSLv3 is 18 years old and the technology behind it is obsolete and insecure.Having security in mind, we have limited SSLv3 connections within the OpenSRS APIs (domains and email). The vast majority of our resellers already use TLS and if you are still using SSLv3, our recommendation is that you upgrade to TLS as soon as possible to avoid any type of service disruption.If you need to test your TLS connection, you can use our test environment as it no longer accepts SSLv3 connections.

You won’t be affected if:

    • You are using the TLS protocol or if your connection is TLS enabled;

    • You currently use Storefront or process orders through the new control panel or the RWI.


OpenSRS only uses TLS to connect to other systems so this vulnerability has not affected us.

If you have any questions or concerns, do not hesitate to contact support at This email address is being protected from spambots. You need JavaScript enabled to view it.. You can also read the official security advisory on the openssl.org website.

The OpenSRS team

.

2014-10-16 18:06:05
 
Comments List