Digicert

digicert

This is your reminder: Don't forget to check strings with special characters like underscores TL;DR: Underscore and special characters can lead to validation errors Problems Incomplete Validation
Security Risks
Missed Tests
Incorrect Setup
System Inconsistency
Breaking changes with legacy data Solutions Use consistent prefix
Implement strict validation
Check system outputs
Create migration tests
Test with legacy data Context In digital certificate validation, ensuring domain control is critical. An incomplete validation and potential security issues. DigiCert recently encountered such a problem, where they missed adding an underscore prefix. This resulted in certificates being issued without proper validation and a cascade of broken sites with few advancement notices. Sample Code Wrong // Incorrect random value without underscore
let random_value = format!("{}", generate_random_value());
setup_dns_record(
  &format!("_{}.example.com", random_value),
  "dcv.digicert.com"); Right // Correct random value with underscore
let random_value = format!("_{}", generate_random_value());
setup_dns_record(&random_value, "dcv.digicert.com"); Detection [x]Manual You can detect this smell by reviewing the validation process and checking if all required prefixes are consistently applied. You should also store historical data and check the new rules applied to them. Tag(s) Security Level [x]Advanced AI Generation AI-generated code might miss adding specific prefixes unless explicitly instructed. This can lead to security risks if the generated code is not thoroughly reviewed. AI Detection With proper examples and instructions, AI tools can be trained to detect missing prefixes in generated or existing code. Conclusion Skipping an essential part of the validation process, like an underscore prefix, can lead to significant issues. Ensuring such steps are consistently applied and reviewed is crucial for maintaining system integrity and security. Relations https://hackernoon.com/how-to-find-the-stinky-parts-of-your-code-part-xxxviii?embedable=true More Info https://www.digicert.com/support/certificate-revocation-incident?embedable=true https://thehackernews.com/2024/07/digicert-to-revoke-83000-ssl.html?embedable=true https://www.bleepingcomputer.com/news/security/digicert-mass-revoking-tls-certificates-due-to-domain-validation-bug/?embedable=true Disclaimer: Code Smells are my opinion. Credits: Photo by Markus Spiske on Unsplash Security is a process, not a product Bruce Schneier https://hackernoon.com/400-thought-provoking-software-engineering-quotes?embedable=true This article is part of the CodeSmell Series on HackerNoon: How to Find the Stinky Parts of Your Code This is your reminder: Don't forget to check strings with special characters like underscores This is your reminder: Don't forget to check strings with special characters like underscores TL;DR: Underscore and special characters can lead to validation errors TL;DR: Underscore and special characters can lead to validation errors Problems Incomplete Validation Security Risks Missed Tests Incorrect Setup System Inconsistency Breaking changes with legacy data Incomplete Validation Security Risks Missed Tests Incorrect Setup System Inconsistency Breaking changes with legacy data Solutions Use consistent prefix Implement strict validation Check system outputs Create migration tests Test with legacy data Use consistent prefix Implement strict validation Check system outputs Create migration tests Test with legacy data Context In digital certificate validation, ensuring domain control is critical. An incomplete validation and potential security issues. DigiCert recently encountered such a problem, where they missed adding an underscore prefix . This resulted in certificates being issued without proper validation and a cascade of broken sites with few advancement notices. recently encountered underscore prefix Sample Code Wrong // Incorrect random value without underscore
let random_value = format!("{}", generate_random_value());
setup_dns_record(
  &format!("_{}.example.com", random_value),
  "dcv.digicert.com"); // Incorrect random value without underscore
let random_value = format!("{}", generate_random_value());
setup_dns_record(
  &format!("_{}.example.com", random_value),
  "dcv.digicert.com"); Right // Correct random value with underscore
let random_value = format!("_{}", generate_random_value());
setup_dns_record(&random_value, "dcv.digicert.com"); // Correct random value with underscore
let random_value = format!("_{}", generate_random_value());
setup_dns_record(&random_value, "dcv.digicert.com"); Detection [x]Manual [x] Manual [x] You can detect this smell by reviewing the validation process and checking if all required prefixes are consistently applied. You should also store historical data and check the new rules applied to them. Tag(s) Security Security Level [x]Advanced [x] Advanced [x] AI Generation AI-generated code might miss adding specific prefixes unless explicitly instructed. This can lead to security risks if the generated code is not thoroughly reviewed. AI Detection With proper examples and instructions, AI tools can be trained to detect missing prefixes in generated or existing code. Conclusion Skipping an essential part of the validation process, like an underscore prefix, can lead to significant issues. Ensuring such steps are consistently applied and reviewed is crucial for maintaining system integrity and security. Relations https://hackernoon.com/how-to-find-the-stinky-parts-of-your-code-part-xxxviii?embedable=true https://hackernoon.com/how-to-find-the-stinky-parts-of-your-code-part-xxxviii?embedable=true More Info https://www.digicert.com/support/certificate-revocation-incident?embedable=true https://www.digicert.com/support/certificate-revocation-incident?embedable=true https://thehackernews.com/2024/07/digicert-to-revoke-83000-ssl.html?embedable=true https://thehackernews.com/2024/07/digicert-to-revoke-83000-ssl.html?embedable=true https://www.bleepingcomputer.com/news/security/digicert-mass-revoking-tls-certificates-due-to-domain-validation-bug/?embedable=true https://www.bleepingcomputer.com/news/security/digicert-mass-revoking-tls-certificates-due-to-domain-validation-bug/?embedable=true Disclaimer: Code Smells are my opinion. Disclaimer: Code Smells are my opinion. Disclaimer: Code Smells are my opinion . opinion Credits: Photo by Markus Spiske on Unsplash Credits: Photo by Markus Spiske on Unsplash Markus Spiske Unsplash Security is a process, not a product Security is a process, not a product Bruce Schneier Bruce Schneier https://hackernoon.com/400-thought-provoking-software-engineering-quotes?embedable=true https://hackernoon.com/400-thought-provoking-software-engineering-quotes?embedable=true This article is part of the CodeSmell Series on HackerNoon: How to Find the Stinky Parts of Your Code This article is part of the CodeSmell Series on HackerNoon: How to Find the Stinky Parts of Your Code How to Find the Stinky Parts of Your Code

Code Smell 261 - DigiCert Underscores

Phishing and fraudulent emails are on the rise and continue to be major problems for both businesses and consumers. It has become a must for brands to adopt security measures and make it a safe and reliable journey for their customers. Having DMARC, DKIM, and SPF in place, businesses are adopting BIMI, a relatively new authentication standard for another layer of protection. It’s the only visual assistance out of all the other verification methods, helping your recipients identify that your messages are coming from an authentic and legitimate source. BIMI is a great way to build trust in email communication and help avoid phishing. In this article, we will delve into the details of this authentication standard and cover its step-by-step implementation process. What Is BIMI? BIMI, or Brand Indicators for Message Identification, is an email standard that attaches your brand logo to authenticated messages sent from your domain. In other words, it allows you to display the logo next to the email in the recipients’ inboxes. This kind of visual verification helps your users instantly recognize your emails and be more confident in opening them. https://www.youtube.com/watch?v=LjtGwsWDNDY&t=87s&embedable=true Like DMARC, DKIM, and SPF, BIMI is a text record that works by allowing you to publish it in your DNS. The record consists of secure URLs to your logo and your VMC (Verified Mark Certificate, required only by Gmail): v = BIMI1; l = https://example.com/logo.svg; a=https://example.com/certificate.pem When your email is delivered to a BIMI-supported provider, it checks your DMARC policy and retrieves your BIMI text record. Once your logo is found, the mailbox provider will attach it to your email in the recipient’s inbox. Which Mailbox Providers Support BIMI? As far as BIMI, it’s a relatively new email authentication standard; only some inbox providers are supporting it. Here is the list of mailbox providers that support BIMI according to the : BIMI group Inbox providers supporting BIMI: Apple Mail Cloudmark Fastmail Google Gmail La Poste Onet Poczta Yahoo! Zone Inbox providers considering BIMI: Atmail BT Comcast Qualitia Seznam.cz Gmx Yahoo! Japan An Inbox provider not supporting BIMI: Microsoft How BIMI Works: The Main Requirements and Set-up Process BIMI implementation seems complicated and intimidating, especially for businesses new to email authentication standards and just starting to adopt these security measures. But we’ll try to walk you through some of the steps that you need to take to set up BIMI correctly: BIMI works only for domains that are already DMARC compliant and have achieved p=quarantine or p=reject. You can check out for detailed information and everything-DMARC. Achieve DMARC enforcement: this guide BIMI uses this certificate to make sure you have ownership over your logo. This step is optional for mailbox providers and is only required for Gmail. We’ll cover more about this in the next section. Acquire a Verified Mark Certificate (VMC): Make sure you have your brand’s logo located at a secure URL in SVG format. Create a secure URL for your logo: Make sure you have your VMC located at a secure URL in .pem file format. Create a secure URL to your VMC: Now that you have completed all the previous steps, you can generate the BIMI record, and add this TXT record to your domain provider's management console. You can use our free for easier implementation: Generate a BIMI record: BIMI record generator tool To check if your domain uses BIMI, use our free lookup tool and see if your record meets the requirements. Check for an existing record: This is the overall process of setting up BIMI. If you are not experienced in IT or work as an email administrator, this process may be too technical for you. You can contact us any time to help you set up BIMI for your organization. Now, let’s jump to VMC and fully understand its requirements. Introduction to VMC As you noticed, for a proper BIMI implementation, VMC or a verified Mark Certificate is a must for . VMC is a certificate that verifies that you are the legal owner of your logo and have the right to display it next to your emails in the inbox. mailbox providers like Gmail Using your logo with this certificate makes it harder to spoof, as it’s verified by the trademark organization. Now, let’s go through the step-by-step process of acquiring VMC: Become DMARC compliant Just like BIMI, for VMC, is compulsory. This is the first and most important step in not only acquiring the certificate but also adopting BIMI as an email authentication standard. becoming DMARC compliant Trademark your logo Next, you need to register your brand logo as a trademark in an intellectual property office or make sure that it’s already trademarked. Currently, this step is required to qualify for VMC. However, in the future, the standard may expand and include not-registered logos as well. Ensure your logo is formatted correctly Before applying for the certificate, ensure that your logo is in a proper .svg format. Register for the certificate Contact or Entrust certificate authority to request your VMC. By the way, we have partnered with DigiCert to make the BIMI implementation easier and smoother for our customers. As soon as your request is approved, you’ll receive the Privacy Enhanced Mail __ __file. Upload it to your public web server, and you’re ready to go. DigiCert (PEM) What Does BIMI Mean For Your Business? The blue checkmark next to the verified users on social media is not something new, and we all know about the impact it has on us while interacting with such profiles. It’s similar to what we have here with emails, except this blue checkmark indicates that the domain owner has gone through email authentication processes and reached the DMARC “reject” policy. It helps recipients be sure that the email they just received comes from a legitimate source and is authenticated. As verification becomes widespread, more and more businesses are expected to adopt such measures. As a result, phishing emails and any attempt of impersonation will become even more obvious, and your users will instantly identify and ignore them. Now, let’s highlight some key benefits of adopting BIMI: Enhance Your Brand Value Proper BIMI implementation also means having DMARC, SPF, and DKIM authentication standards in place. This demonstrates your commitment to email security and how important it is for your brand to protect your customers and subscribers from cyber attacks. Build Trust As already mentioned above, BIMI builds trust in your email communication. It helps your consumers have confidence in engaging with your content and be sure that the messages are authenticated with DMARC. Increase Deliverability and Boost Marketing Campaigns With a verified BIMI logo, your emails stand out from the rest in the inbox. This not only encourages more open rates but also lowers the chance of being reported, marked as spam, or unsubscribed. Such metrics play an important role in enhanced email deliverability and more effective marketing campaigns. Creating a valid BIMI record and putting it into action may seem challenging at first. However, it’s becoming increasingly popular as phishing attacks continue to evolve. More and more brands are adopting this email authentication standard, making the safety and protection of their users a priority for them.

What Is BIMI: Your Verified Brand Logo Next to Your Email in The Inbox

BIMI কী: ইনবক্সে আপনার ইমেলের পাশে আপনার যাচাইকৃত ব্র্যান্ডের লোগো

Was ist BIMI: Ihr verifiziertes Markenlogo neben Ihrer E-Mail im Posteingang

¿Qué es BIMI? El logotipo de su marca verificada junto a su correo electrónico en la bandeja de entrada

Qu'est-ce que BIMI : le logo de votre marque vérifié à côté de votre e-mail dans la boîte de réception

BIMI क्या है: इनबॉक्स में आपके ईमेल के आगे आपका सत्यापित ब्रांड लोगो

BIMI とは: 受信トレイのメールの横にある認証済みのブランド ロゴ

BIMI란 무엇입니까? 받은 편지함의 이메일 옆에 확인된 브랜드 로고가 표시됩니다.

O que é BIMI: o logotipo da sua marca verificada ao lado do seu e-mail na caixa de entrada

Что такое BIMI: логотип вашего проверенного бренда рядом с вашим адресом электронной почты во входящих

BIMI Nedir: Gelen Kutunuzdaki E-postanızın Yanında Doğrulanmış Marka Logonuz

BIMI là gì: Logo thương hiệu đã được xác minh của bạn bên cạnh email của bạn trong hộp thư đến

什么是 BIMI：收件箱中电子邮件旁边的经过验证的品牌徽标

Let's say JayP wants to connect to youtube.com over the public internet. Before any communication occurs, some concerns will arise: How can he verify that he is indeed communicating with youtube? (Authentication) How can JayP know that no one has intercepted his message? (Confidentiality) Also, how can he be sure that no one altered the message? (Integrity) Well, let's tackle each problem separately.
First of all, JayP should verify the identity of . For that, he needs Youtube's public key. The public key represents youtube's identity. Youtube The Problem The problem is, attackers have come up with ways to intercept a request from one computer to another computer on the Internet and launch a . With this kind of attack, our attacker Chady would inject his own public key and have JayP think he is communicating with Youtube, while actually, he is communicating with Chady. man-in-the-middle attack Chady sneaks in and sends HIS public key. Now you may think, scary, isn't it? Imagine what could be possible with this kind of attack, from stealing personal information such as login credentials or credit card details to malware distribution or other malicious goals. How then, can JayP be sure that the public key he received comes really from Youtube? That's where digital certificates come in. (TADAAA) They ensure that the public key is indeed coming from Youtube, and not from a malicious Chady. Actually, digital certificates can be used not only for HTTPS, but also for mail, IOT, and VPN… Information Inside TLS Certificate A digital certificate will contain quite a bit of information, let's explore the most important ones: is the third party that signed this certificate, we'll get into it in a bit. Some basic information will include the Common Name, the organization, and the country. The issuer Of course, a digital certificate will also include its , with two critical fields, not before and not after Validity The is the owner of the certificate and would be Youtube in our case. The subject will contain information such as common name, address, and most importantly, the public key. Subject Lastly, a digital certificate includes its . This is the signature signed by the issuer that proves that this certificate is authentic. Signature Who signs the digital certificate? Digital certificates are signed by entities called certificate authorities (for example DigiCert, Comodo, Symantec, Google Trust Services). But wait, what are certificate authorities? Well, in a nutshell, Certificate Authorities are trusted third-party organizations responsible for issuing digital certificates. Certificate authorities have their own public and private keys. From that, let's explain how signatures are made. The previously mentioned information contained in a digital certificate will be hashed using an , for example. After the hash is generated, the certificate authority encrypts the hash using its private key using RSA asymmetric key encryption. This encrypted hash is the signature of a certificate, and can only be decrypted using the certificate authority's public key. Anyone with the public key of the certificate authority who has signed this certificate can decrypt and verify that the certificate is authentic and has not been tampered. SHA-256 algorithm When the browser receives the certificate, it will hash all the information on its side using the same hash algorithm, in this example, SHA-256. Then, it decrypts the signature using the certificate authority's public key to have the hash received from the certificate authority.
If both hashes match, then the browser can confirm that this certificate is truly coming from the claimed certificate authority. Hierarchies for Certificate Authorities Hierarchies exist for certificate authorities - the root certificate authority, and the intermediate certificate authority. These root CA does not actually directly issue any digital certificates for servers. It only issues digital certificates for intermediate CAs that act on its behalf. The intermediate CAs can either issue digital certificates for another intermediate CA or for a server directly. Hence, There is a chain of trust, from the root CA to the server. Operating systems come bundled with a trust store, which is a list of trusted root certificate authorities. This list is maintained by the companies that make operating systems such as Apple and Microsoft. They all require a root certificate authority to undergo one or more audits proving their trustworthiness and validity. How does all of this fit into the picture? Let's visualize the whole process from the start. First of all, let's assume youtube.com is a brand-new startup. Understanding the need to be secure on a publicly available internet, Youtube would have to own a trusted digital certificate and present it to its visitors. Step 1: Youtube goes shopping for a digital certificate First of all, Youtube goes searching for an intermediate certificate authority. Remember that intermediate certificate authorities are middlemen between servers and root certificate authorities. In the case of Youtube, Google has its own certificate authority called Google Trust Services. After picking an intermediate CA, Youtube makes a certificate signing request. The certificate signing request will contain information that will be included in Youtube's digital certificate, such as common name, organization, and most importantly the public key of Youtube. Youtube will send the certificate signing request to the intermediate CA. The intermediate certificate authority will verify the CSR containing information about the owner also referred to as the subject. Then, it adds fields like issuer information, which is information about the intermediate certificate, and the validity, then signs all this information as explained previously in the signing process. After signing, the intermediate certificate authority will send back the digital certificate for youtube. Youtube can now attach its newly bought digital certificate to its web servers. Step 2: JayP connects to youtube.com to watch fitness videos When he connects to Youtube, Youtube will send its own certificate and certificates of intermediate certificate authorities. The root certificate authority will not be sent because it is available on JayP's Operating System. Youtube's certificate will include the issuer information, which is the intermediate certificate authority. The browser will hence know that this certificate is signed by Google Trust Services Intermediate Certificate Authority, and will have its certificate. Any digital certificate will contain information, and a signature, as explained previously. The browser will hash all the information to obtain its hash value. Then, it will decrypt the signature using the issuer's public key, in other words, the intermediate certificate authority's public key. Again, remember that the signature can only be decrypted using the issuer's public key. After that the browser will compare the two hash values, if they are the same, then this part of the chain is verified, and the browser will move on to verifying the intermediate certificate authority because as explained, intermediate certificate authorities are not trusted directly by the operating systems. Okay, now the browser will verify the certificate of Google Trust Intermediate Certificate Authority. This intermediate certificate is signed by Google Trust Services Root Certificate authority. Please note that before this step, we could have many intermediate certificate authorities between the end certificate and the root certificate, and for each part of the chain the same verification process will happen. In our example, we will just stick to one. The signature of the certificate of the intermediate certificate authority will be verified with the public key of the root certificate authority, as stated previously. When reaching the root certificate authority, that's where the chain ends. The root certificate authority, which is self-signed, will be available in JayPee's operating system's trust store. That's it! The browser, after this verification, will display a nice-looking lock icon, like the one in your browser. Now it is guaranteed that the communication is really with Youtube and that it is safe (HOORAY) Three types of Domain Certificates Before we wrap up, we will shortly explain three main types of TLS certificates. 1) Single Domain Certificate A single domain certificate is designed to secure a single fully qualified domain name. It means that the certificate is valid only for one specific domain and does not cover any subdomains or additional domains. For example, for the domain "www.youtube.com," a single domain certificate would secure only that domain and not any other variations like "academy.youtube.com" or "blog.youtube.com" Use cases: Single domain certificates are ideal when you have a single website or web application that does not require additional subdomains. They are the most straightforward and cost-effective option for securing a specific domain. 2) Wildcard Certificate Next, we have a wildcard certificate, which is a type of TLS certificate issued for a main domain and all its subdomains using a single certificate. The wildcard character asterisk is used in the Common Name (CN) field or Subject Alternative Name (SAN) field to indicate that any subdomain under the specified domain is covered. For example, if you have a wildcard certificate for " ," blog.youtube.com", and so on. .youtube.com," it would secure "youtube.com," "academy.youtube.com Wildcard certificates save you from having to manage and renew individual certificates for each subdomain. However, it's essential to note that wildcard certificates only cover one level of subdomains. For instance, a wildcard certificate for "*.youtube.com" would not cover "academy.blog.youtube.com." Use cases: 3) Multi-Domain (SAN) Certificate A multi-domain certificate, also known as a Subject Alternative Name certificate, allows you to secure multiple unrelated domains within a single certificate. Each domain or subdomain to be secured is listed in the Subject Alternative Name (SAN) extension of the certificate. For example, Google and other large companies would use these multi-domain certificates. One of the main benefits would be Simplified Certificate Management: Google operates a lot of web services and applications, each with its own domain or subdomain. Using multi-domain certificates allows them to consolidate the management of certificates for multiple domains or subdomains into a single certificate. This streamlines the process of certificate issuance, renewal, and monitoring. And, That's it. Please take some time to watch the animated lesson. https://youtu.be/OU-e_Qz-v4U?embedable=true In my next article, I will discuss encryption with TLS. Also published here.

A Simplified Guide to TLS Certificates 📝 

TLS শংসাপত্রের জন্য একটি সরলীকৃত নির্দেশিকা 📝

Eine vereinfachte Anleitung zu TLS-Zertifikaten 📝

Una guía simplificada de certificados TLS 📝

Un guide simplifié des certificats TLS 📝

टीएलएस प्रमाणपत्रों के लिए एक सरलीकृत मार्गदर्शिका 📝

TLS 証明書の簡易ガイド 📝

TLS 인증서에 대한 단순화된 가이드 📝

Um guia simplificado para certificados TLS 📝

TLS Sertifikaları için Basitleştirilmiş Kılavuz 📝

Hướng dẫn đơn giản về chứng chỉ TLS 📝

TLS 证书简化指南 📝

Are you ready to make the switch to a new hosting provider? Some typical reasons to transfer web hosting include improving site performance, cutting down on server downtime, and increasing security. If you want to transfer your website to a new host, this how-to article outlines the step-by-step process for a smooth migration. From choosing plugins to managing site files to downloading and exporting your website database, this tutorial has everything you need to switch quickly and easily! Are you Using a Content Management System like WordPress? If you built your website using a content management system like , you've made your migration much more manageable. WordPress offers exceptional tools to help in migrating a site. Even without the tools, the process is relatively straightforward. WordPress If you do not have a WordPress site but a CMS such as Joomla, Drupal, or another, you will have a similar approach to the one outlined in this article. However, this article references WordPress and provides steps for transferring WordPress sites. Have you Purchased New Website Hosting? A new web host is an integral factor in transferring a website. You'll want to select a new host and set it up before initiating any website transfer or migration from your previous hosting provider. There are many excellent hosting options for WordPress websites, whether you want to invest a little or a lot. You can choose from multiple plans like shared, managed, cloud, VPS, or dedicated hosting. All come with their benefits and drawbacks. We don't provide specific details on each in this tutorial, but you can find this information in our article. how to host a website Related Content: Managed WordPress Hosting – Is The Quality Really Better? Does the Host Offer Free Migration Services? You've probably heard the saying, “time is money.” Transferring your old hosting account to a new host account can be time-consuming. That's why choosing a host that offers free site migration is important. This will save you a lot of time and hassle. Additionally, read the host's website and FAQ section carefully to know what needs to be done before transferring your site. Once you understand the process well, it's time to get started. Follow the host's guidelines carefully to avoid any complications. And last but not least, ensure you have a backup of your website files in case something goes wrong during the migration process. Steps to Switch Hosting Providers Website migration can seem daunting, but switching web hosts can be easy and successful with some preparation and instruction. Follow these six simple steps to make the process go smoothly. Reach out to your new host support if you get stuck. They are typically more than willing to pitch in when you buy their services. Step 1. Backup your website Before you start any migration process, ensure you have a downloaded copy of your website files and database somewhere locally or in online storage like Google Drive or DropBox. The reason is that if something goes wrong and something happens to your old site during the process, you can always restore from the backed-up copy. Step 2. Download your website files Next, you'll want to download your website. This can be done manually, or it can be done using a plugin in just a few clicks. Many great plugins can assist with migrating a WordPress website. If you want to download your website's files manually, your best option is FTP. The file manager within the control panel is suitable for downloading a single or a few files but doesn't allow for downloading entire folders and/or subdirectories. We recommend trying one of the following plugins to obtain your files before going through the FTP process. Exporting via FTP client. FTP stands for file transfer protocol, and it is the best way to transfer files between your local environment and a remote host. We typically use as our FTP program; it is free and works efficiently to connect to your website and files. Once downloaded and installed, you'll need to connect it to your website via the host's FTP username, password, and related security settings. FileZilla Open FileZilla – Under in the main navigation, click on . You'll see this modal window pop up on your screen. File Site Manager You'll next need to create a new website, assuming it is not listed and you've not used FileZilla before. Add the connection details to the fields on the right-side panel and press . Connect Next, you'll see FileZilla working to connect to your remote host. If everything is entered correctly, you'll see the remote server files in the right-side panel. If nothing shows up, you'll likely receive an error message in the connection panel, #1, and you need to reenter your information and try again. Once you've successfully connected, you'll need to navigate where you want to store the downloaded files on your local machine. You'll then navigate to where your website folder and files are in the right-hand panel. This folder is typically public_html, but depending on the host, it could be labeled with your domain name or another identifier. You'll want to connect with support to inquire if it is not apparent. Drag and drop the unzipped folders and files from the right panel to the left panel. As you do so, you'll see the bottom panel become active, showing the transfer status of the folders and files. It is essential to monitor this as you want to ensure there are not any errors upon completion. Errors typically mean some files failed to transfer, and you'll need to try those again. Additionally, two tabs are across the bottom panel to view failed and successful transfers. Step 3. Export your website database If you've made it this far and have decided to migrate your website manually, you'll next need to export your MySQL database. This process will grab all your website's tables within the site's database. This is done manually by accessing your control panel and your phpMyAdmin panel. Once you've accessed your panel, you'll need to navigate to the proper database by name. If you haven't named your database or do not remember the name, you might need to search for one with multiple table entries. Once you've found your database, click on the Export link at the top of the page, then choose the file type you want to export as and hit the “GO” button. Your files will then be downloaded, and you asked where you want to place the file on your local machine. Step 4. Upload your website and import your database Once your new web hosting provider is set up and ready to receive your WordPress website, you'll need to upload your website files and import your database. This process can be taxing if you've never done it before and choose to do it manually. We highly recommend using the plugins outlined above to make it easier to set up and connect the website without issues. Upload via File Manager Uploading your website using a file manager is not a complex process. However, ensure you have all the files ready before uploading anything. You'll open the File Manager from your control panel and navigate to where the files must go, typically labeled as public_html or your website domain name. You'll click into that folder and then click the Upload button on the main navigation. That will likely open a new screen that you will use to select the files you want to upload and then press the Upload button. Upload via FTP If you upload manually, you can upload the files to your new hosting account via FTP, reversing the downloading process outlined in step 2. Step 5. Test your website Testing your website after transferring it to the new web hosting account is vital to ensure everything goes smoothly. If there are any issues, you'll want to fix them before launching on the new web host. Ensure all content is up-to-date and transferred successfully and there are no issues with broken images, links, redirects, etc. Once you've confirmed that everything looks good and is working as expected, the last step is to repoint your domain to the new host and push the new site live. Step 6. Pushing the website live You'll need to correct your DNS settings to point your domain away from your current hosting account to your new hosting provider. This could be easy or difficult depending on how you've set up your domain. You have your nameservers pointed to your domain registrar servers (think GoDaddy, Namecheap, etc.), and you need to point an A record to the new web hosting provider's issued IP address. Or you can use a CNAME record and point that to the IP. This method virtually eliminates website downtime. Easy: You previously transferred your nameservers to your current website hosting account and will need to transfer them back to your domain registrar. Once that is completed, you'll need to repoint them to your new hosting company. This method typically means there could be downtime of 12-48 hours for your website. Hard: We don't typically advise moving nameservers from your domain registrar as it can cause these problems when making a web host switch. It can take time for the nameservers to propagate, which might mean downtime for your website. Using the A or CNAME record is much easier and more efficient. Important Considerations for WordPress Sites 1. Backup your website Always back up your website and ensure a local copy is stored safely and securely. We can't emphasize this enough. If you skip this step and something goes wrong, you may lose your website. Considering free plugins help you accomplish this, there should be no reason not to back up your site as best practice on a regular cadence. Ensure your backup files and any MySQL database are on your current and new hosting providers. 2. Check your DNS settings Ensure your DNS settings are appropriately constructed at your domain name registrar to allow an easier transfer. If you ensure your domain DNS settings are set up to make your site transfer easier before you start the migration, you'll eliminate issues and website downtime. 3. Check your SSL certificate Moving your website typically means getting a new SSL certificate or having to be reissued a new certificate signing request and private keys. SSL certificates issued by hosting providers do not transfer, so you'll want to ensure your new host is ready to support your website with a new SSL certificate. Suppose you've purchased an SSL from a third-party provider like Comodo or DigiCert. In that case, you'll need to reach out to them to have it reissued so you can place the signing request and private keys into the appropriate control panel area or hand it off to the support team at your new hosting company. 4. Make sure you don't have missing or broken images During your final testing, you should ensure all images are showing and that you don't see any missing or broken images on the website. You'll also want to check this on a mobile device to ensure everything works as expected across different devices. It should, but it's always best to do your due diligence before it becomes an issue on a live website. If you see missing elements or images, you'll have access to your old hosting provider and site's files, so moving images over to your new site will be easier. 5. Fix any broken links & check redirects When you transfer web hosting, it can sometimes result in broken links. You can run broken link checker tools like Check My Links and Bad Link Checker, both Chrome extensions that you can add to your browser through the Chrome Web Store. You can also add a Chrome extension called Redirect Path that will trace your redirects to ensure you don't have any issues. These tools are all free to use to ensure your website works as expected. 6. Check your site tracking Sometimes moving a website will result in losing tracking tags or analytics. You want to ensure that your tracking tags are still placed within the site code and actively capturing data. This is rare with just a web host move, but it is better to review and find no errors than not to review and have it not track your site for months before it is caught. 7. Let Google know about the site transfer Once you've completed the transfer successfully and tested your site, you can let Google know that your site is at a new host. Yes, you can provide with a new XML sitemap so the crawler will recrawl the site pages and let you know what might need to be fixed. Google Search Console The reason to submit a new sitemap is that it is the best way to tell Google that you want them to re-crawl your WordPress site. Additionally, you want to do this if your website speed has dramatically improved, as this is a ranking factor, and you'll want Google to provide your site as much of a boost as possible after your transfer. How to Transfer your Website to a New Host Wrap-up Hopefully, the information provided and the steps outlined make it easy to understand the process of migrating services for your website from one web host to another. The process is made easier when you leverage WordPress's inherent technology to help with these types of migrations. If something goes wrong, the plugin approach will save you time, money, and headaches. Remember, your new web hosting provider will be your best source of support if you experience an issue during this process. Many site owners go it alone but don't have the technical knowledge. You're paying money for your new hosting service, so tap into their support if you can't figure something out; that's why they are there, and more than likely, they'll help you figure it out or do it for you. Also published . here

Effortlessly Transfer Your Website to a New Host in 6 Simple Steps

Transfiera sin esfuerzo su sitio web a un nuevo host en 6 pasos simples

Transférez sans effort votre site Web vers un nouvel hôte en 6 étapes simples

6 सरल चरणों में सहजता से अपनी वेबसाइट को एक नए होस्ट में स्थानांतरित करें

6 つの簡単なステップで簡単にウェブサイトを新しいホストに転送

Transfira sem esforço seu site para um novo host em 6 etapas simples

Dễ dàng chuyển trang web của bạn sang máy chủ mới trong 6 bước đơn giản

通过 6 个简单步骤轻松将您的网站转移到新主机

Over the last few days, website owners, specifically those hosting on GoDaddy, have been experiencing strange redirects to various websites. These redirects don’t happen all the time, but they seem to happen when a user first visits a page or refreshes it enough times to trigger it. I first stumbled upon this issue when visiting a website of a favorite restaurant of mine. Instead of seeing a page with pictures of food, menus, etc., I was presented with a . fake AV page How it works Like with other security issues I discover, I end up jumping down the rabbit hole to investigate what this is, how it works, and whether there is a way to avoid it. Unfortunately, for this incident, the best perspective I can give is as an outsider. A compromised GoDaddy website would make this investigation easier, but it isn’t impossible without it. At a high level, the sequence of events is as follows based on testing and other observations: 1. The user visits a compromised website hosted on GoDaddy. Like me, users could visit a local business’s website they are familiar with. 2. Initial redirect occurs Through some black box logic (usually for first-time visitors or by chance), GoDaddy servers send a to the user to redirect them to the attacker’s website. Every compromised website I’ve found redirects to . 302 46.4.68.136 Currently, there is speculation that GoDaddy’s load balancers are compromised. Specific requests will redirect you to the attacker’s page, but this occurs less often than expected. The cached versions of these compromised sites show a redirect in the HTTP response’s header. This header will cause the browser to redirect to the website specified in the variable. path Below are some examples. HTTP/1.1 302 Found
Date: Fri, 16 Dec 2022 22:23:24 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-cache
Pragma: no-cache
Set-Cookie: b64618f79bd8f79428b7f1f80c1abceb=qtjmovs3948hi5t1m2shhambr4; path=/
Location: http://46.4.68.136/[REDACTED]?DOM=www.vocationalvisions.com&URI=%2findex.php
Connection: close
Vary: Accept-Encoding
Content-Type: text/HTML; charset=utf-8 HTTP/1.1 302 Found
Date: Sat, 17 Dec 2022 17:21:14 GMT
Server: Apache
X-Pingback: http://www.bookkeepingservicesclt.com/xmlrpc.php
Location: http://46.4.68.136/[REDACTED]?DOM=www.bookkeepingservicesclt.com&URI=%2findex.php
Connection: close
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8 HTTP/1.1 302 Found
Date: Fri, 16 Dec 2022 14:43:04 GMT
Server: Apache
Location: http://46.4.68.136/[REDACTED]?DOM=www.daria-snadowsky.com&URI=%2findex.php
Connection: close
Vary: Accept-Encoding
Content-Length: 0
Content-Type: text/html; charset=UTF-8 HTTP/1.1 302 Found
Date: Tue, 13 Dec 2022 14:00:31 GMT
Server: Apache
X-Powered-By: PHP/5.6.40
Link: <http://saslist.com/wp-json/>; rel="https://api.w.org/"
Location: http://46.4.68.136/[REDACTED]?DOM=saslist.com&URI=%2findex.php
Connection: close
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8 HTTP/1.1 302 Found
Date: Wed, 14 Dec 2022 00:20:15 GMT
Server: Apache
X-Powered-By: PHP/5.6.40
X-Pingback: http://paypointeinc.com/xmlrpc.php
Location: http://46.4.68.136/[REDACTED]?DOM=paypointeinc.com&URI=%2findex.php
Connection: close
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8 These websites receive a response from an Apache-powered server and will redirect the user to the same malicious IP address -- whether they use WordPress or not doesn't play a factor. Every user that ends up being redirected to the attacker's host is then tagged with a cookie set from the response header. Every subsequent request on that host will also include that cookie to identify the victim. Set-Cookie: a8163=<JWT looking token> 3. The second redirect occurs Redirect takes the user to a specific page on the attacker's website. This page then runs JavaScript to redirect them to phishing or pornographic content. The basic structure of the page we see is as follows: <html>
        <head>
            <script type="application/javascript">
                function process() {
                   if (window.location !== window.parent.location ) {
                      top.location = "http://bad.website";
                   } else {
                      window.location = "http://bad.website";
                   }
                }
                window.onerror = process;
                process();</script>
        </head>
        <body>
            The Document has moved <a href="http://bad.website">here</a>
        </body>
        </html> Notably, you can find very similar snippets on Github. The redirect above isn't a new tactic used to redirect users. After this redirect, the user is at the attacker's final destination. About the attacker's site I've played around with the attacking site. Fun fact: the redirect page changes depending on your IP/location. The page would redirect me to the fake AV scanner if I were in North America. If I were in Europe, Asia, South America, etc., each would redirect me to different pages showing less-than-desirable content. Is this done intentionally to specialize attack payloads based on some level of effectiveness according to location, or is it just done randomly? Why this is serious In general, the attack is widespread, where we can find many compromised websites with a simple Google search of the attacking website's IP address. Many website owners are affected by this, as evinced by this support question. Notably, even this found its way to one of the links in the SvelteKit docs. Cloudflare issue It is not apparent that the attack impacts WordPress plugins, as demonstrated. Newly provisioned accounts are also affected even with no content uploaded to the website. @ColinQuarello From this, we can assume that this could be a system-wide issue for the hosting provider. 302 redirects are happening from your load balancers to spam/porn sites on the shared hosting infrastructure. I provisioned a new account and immediately got a 302 redirect when there was . Headers looked forged too. This is serious. @GoDaddyHelp @GoDaddy no content on the site — Colin Quarello (@ColinQuarello) December 19, 2022 Once a user is in the hands of the attacker by being on the attacker's website, they can succumb to social engineering, phishing, etc. alone cost companies and the general public billions per year. Phishing scams On the human side, this incident can lead to a loss in user trust not only for GoDaddy but also for small to medium-sized businesses that rely on the platform to host their company's website, e-commerce store, etc. These days, user trust is more important than ever to foster user growth and business expansion. According to a study done by , "84% of consumers would switch to a competitor if they lost trust in the enterprise". A single incident, let alone repeated occurrences, will degrade user trust faster than a business can regain it quickly. DigiCert Latest Developments As of 2022-12-20, GoDaddy is currently working on this incident (INC-5492776). I am unsure if this is an internal incident tracking number or something GoDaddy customers can access. We're aware of the issue and working to correct it now. I can assure you that our teams are diligently working to restore service as soon as possible. ^CG — GoDaddy Help (@GoDaddyHelp) December 20, 2022 Previously, it was suspected to be a firewall-related issue, but this has since been disproven. GoDaddy engineers and users have found this issue occurring regardless of firewall configurations. Thanks for reading! 💎 Thank you for taking the time to check out this post. For more content like this, head over to my actual . Feel free to reach out to me on and follow me on . blog LinkedIn Github

GoDaddy Hit with Widespread Redirect Hack

GoDaddy golpeó con redirección generalizada Hack

GoDaddy Hit avec un piratage de redirection généralisé

व्यापक रीडायरेक्ट हैक के साथ GoDaddy हिट

GoDaddy がリダイレクト ハッキングの被害に遭う

GoDaddy é atingido com hack de redirecionamento generalizado

GoDaddy thành công với hack chuyển hướng rộng rãi

GoDaddy 遭遇广泛的重定向黑客攻击

Top Software Development Companies 2022 That Are Growing Fast

Certificate chains are used to be able to verify an end user certificate against a list of intermediaries and a root authority. We are going to explain this in a bit more detail. The Certificate Authority In order for an SSL certificate to be trusted, a certificate must have been issued by a certificate authority (CA) that is included in the trusted store of the device that is connecting. If the certificate was not issued by a trusted CA, the connecting device will then check to see if the certificate of the issuing CA was issued by a trusted CA, and so on until either a trusted CA is found or no trusted CA can be found. Common certificate authorities Commonly used certificate authorities, such as Verisign, DigiCert, and Entrust, are automatically trusted by most browsers. However, if you use an untrusted internal certificate authority to generate SSL certificates for internal resources, you will be nagged by your browser when you attempt to connect. Example of when an SSL certificate is not trusted. How a Certificate Chain Works You decide to purchase a certificate for the domain from a certificate supplier called It’s important to note, that certficates.ca is not a root authority, and therefore cannot be explicitly trusted. google.com certificates.ca. A chain of trust must be built, by certificates.ca having intermediate certificates issue certificates up the chain all the way to a root CA. Here is an example of a 5 chain certificate: google.com — issued by certificates.ca (end user certificate) intermediate certificate — issued to certificates.ca, issued by some-intermediate-1.ca intermediate certificate — issued to some-intermediate-1.ca, issued by some-intermediate-2.ca intermediate certificate — issued to some-intermediate-2.ca, issued digicert.ca root certificate — issued to digicert.ca, by digicert.ca - (Your Private Key: your_domain_name.key)
- - (Your Primary SSL certificate: your_domain_name.crt)
- - (Your Intermediate certificate: DigiCertCA.crt)
- - (Your Root certificate: TrustedRoot.crt)
- ---- RSA PRIVATE KEY----- BEGIN ---- RSA PRIVATE KEY----- END ---- CERTIFICATE----- BEGIN ---- CERTIFICATE----- END ---- CERTIFICATE----- BEGIN ---- CERTIFICATE----- END ---- CERTIFICATE----- BEGIN ---- CERTIFICATE----- END Installing a certificate When you install an end-user certificate, such as the one in the example above bought from certificates.ca, you have to bundle the intermediate certificates and install them also. This certificate chain enables the receiver to verify that the sender, and all certificates in the chain are trustworthy, but if the SSL certificate chain is invalid or broken, your certificate will not be trusted by some devices. Previously published at https://codeburst.io/understanding-certificate-chains-b55162d95312

How Certificate Chains Works

These unprecedented times have pushed us to adapt distinctive lifestyles contrary to what we’ve been used to for a millenia. Industries like finance, law, banking and the public sector where culture has traditionally frowned upon working-from-home, are compelled to succumb to such mandates out of necessity. As much rampant the unfortunate layoffs, hiring freezes, and budget cuts across travel and hospitality industries are, And this is an important observation that we can’t afford to overlook. data breaches have been on a steady rise. Increased reliance on digital technology, VPNs and network infrastructure calls for a greater need to protect them, lest one drew attention from adversaries. To dig deeper into the reality of the 'new normal', I decided to interview over a dozen businesses and security experts asking for their insight into  the matter. Here's what businesses and security experts have to say: “It’s no secret that most businesses struggled with IT security before the COVID-19 crisis. Many lacked the infrastructure and security required to handle the shift to remote working while keeping critical systems secure,” says , CEO of , a leading provider of secure digital identity management solutions. “Working from home has accelerated the number of connection points in the network and the certificates and keys they rely on. Ensuring visibility to and the security of those connections is mission critical – lack of adequate management can lead to systems disruptions, outages and even breaches.” Jordan Rackie Keyfactor , VP of Innovation at managed services provider notes, “[We have] seen a huge increase in demand for VPN connections since working from home began (peak of 762% on April 6), as well as a 100% increase in the number of abuse email notifications sent.” They’ve been busy helping clients navigate how to modernize current IT structures with a focus on security. Ray Watson Masergy Then there’s the never-ending series of data breaches impacting major players and making headlines. From , , and other breaches, to the hacked representing big names like and , there’s chaos all over. Not to forget, a second wave of ransomware attack (‘Maze’) that got the postal tech giant And, the dating app breach impacting some 3.6M users. And lastly, the return of Thunderbolt data extraction flaw, dubbed “ ” this time around: Ghost DigiCert SaltStack law firm Lady Gaga Madonna Pitney Bowes. MobiFriends thunderspy all within a thirty day span, and at a time when businesses are most vulnerable. Business, budgets, and cuts From an executive and managerial standpoint, cutting immediate losses in these unforeseen times seems to be the pragmatic step, and is often necessary. However, looking at the bigger picture, one must be careful that any such step undertaken with the objective of curbing spending doesn’t backfire, resulting in even bigger problems in near future.  And is often the paramount issue when organisations scrutinise their security budgets, and contemplate cuts. that “We have definitely had to cut our cybersecurity budget. Unfortunately right now it comes down to paying payroll, or making temporary cuts where we can. Cybersecurity was the last of these cuts,” says , President, . “We’re not without any protection [and] we take security risks very seriously. Every employee has to be more accountable now, as a [breach] will almost certainly fall on our shoulders.” Bailey hopes the disruption would be ephemeral and intends to reinstate the necessary resources immediately, once the funds allow for it. Dan Bailey WikiLawn On the contrary, , Director of states his company has had to augment their budgets: “Cybersecurity has been one of our big concerns, since we had to transition everyone to full-time remote. We did increase our cyber-security budget, and we provided everyone with training and software, to limit our vulnerability as much as possible. Our research shows that at least half of these kinds of attacks happen because of employee breaches, so we’re on top of it. Obviously, we’re relying on our website more than ever, and the last thing we need is an attack.” Sean Nguyen Internet Advisor Surely, temptation arises to put aside that cash cushion and halt any activities deemed unnecessary. But that is a risk too big to take, when discussing information security—effectively a tangible form of insurance your infrastructure thrives on. “Enterprises should make sure cyber security remains a top priority and not let their guard down,” says , head of the at Juniper Networks. “It doesn’t take much for a threat actor to infiltrate a network, once a vulnerability is exposed. Sometimes, it means reaching beyond the corporate perimeter to top employees’ homes to help them have the correct set up. A Wi-Fi access point with cloud management capability goes a long way towards securing the access your C-suite needs to have from home, for example.” Mounir Hahad Juniper Threat Labs Insider and outsider threats With increased dependency on a totally remote workforce more so than ever, and no immediate plans to return to the office, there’s a lot at stake for businesses. There’s the obvious risks of employees falling for ransomware and phishing scams. But now, unless a company’s security controls can extend to an employee’s home-office setup, there is little visibility into the possibility of insider threats, such as data exfiltration and insider trading. , VP of Product Management at California-based cybersecurity firm suggests, “investing into automation of laborious tasks, such as change auditing and user behavior analytics, so the IT team could focus on more strategic areas. Moreover, such solutions will speed up detection and investigation of potential incidents, and if you set alerts on suspicious user behavior patterns, you will be able to quickly address security issues without sacrificing other IT tasks.” Ilia Sotnikov Netwrix An increased attack surface also favours malicious actors preying on the weakest link, and opens up doorway to remote attacks geared towards unsavvy employees. “The simple fact is that the likelihood of data breaches will only increase as systems become more interconnected, employees continue to decentralise and work remotely, and bad actors become more sophisticated in capitalising on security weaknesses,” notes , CEO of , a secure collaboration platform. Morten Brøgger Wire Brøgger stresses, “Not only can a data breach or cyber attack inflict severe financial damage, it can freeze up digital assets which are the lifeblood of an organisation. Without them, there is no product, no service, no sales.” Leveraging existing resources which don’t cost a fortune, or a penny “It’s not necessarily about spending more, but spending smarter. Many solutions require a lot of set up and manual intervention to keep current, which is not sustainable and forces artificial choices between security and affordability. Newer, smarter solutions, however, automate the implementation of security to eradicate the need to choose. If companies can deploy these newer solutions, they can often strengthen their security within their budget constraints,” suggests , CEO and cofounder, . Benny Lakunishok Zero Networks Security awareness trainings “People are still responsible for operating, whether it’s local or in the cloud, and humans make mistakes. Even if they can’t invest in security software due to tight budgets, a company’s leadership should dedicate time each month in security awareness training, such as how to spot an email that could potentially be a phishing scam,” says , CEO and Founder of , the creators of “security awareness trainings your employees will love.” Nick Santora Curricula Additionally, , a cybersecurity expert and CEO of suggests running phishing simulation exercises. “There are a number of organizations that offer free online courses that cover best practices that you can implement for your business.  I recommend taking this a step further, and running simulated phishing tests for your staff.  That will identify your staff members that need additional security awareness training.” Courtney H. Jackson Paragon Cyber Solutions Network security and open source solutions of Guidepost Solutions had some practical tips to share on the networking front. “Companies can increase their network security without impacting their spending, through several tactics: if possible, move [your] services to a robust and secured cloud solution, implement layer 1-4 TCP/IP model network security best practices, utilise multi-factor authentication, encrypt all types of data communication, and [lastly,] install and update antivirus and antispyware on all machines.” Ahmad Zoua In the open source scene, there are a plethora of “community editions” and free versions of popular security products that can be leveraged by IT professionals and developers alike. And they often cost nothing. “With all the focus on changes introduced by work from home, it’s easy to lose sight of the fact that most prominent attacks these days focus on deployed applications. Those applications can have latent vulnerabilities sitting in the open source components that comprise about 80% of the code base these days. It’s easy to do an assessment to find out what’s lurking inside your applications,” says , CTO of , the company behind : “a free catalogue of open source components and scanning tools to help developers identify vulnerabilities, understand risk, and keep their software safe.” Brian Fox Sonatype OSS Index , Senior Manager and Head of Cyber Security at additionally offered insight into some free tools businesses can adopt: “There are a surplus of phenomenal open source tools, such as (network monitoring), (intrusion prevention and detection), (full network packet capture), and (open source incident management platform). Most importantly, use this time to level up your employees. Employees are the first line of defense and a force multiplier when it comes to security. Simple things like teaching strong and effective password hygiene as well as running phishing simulations will increase security awareness with little to no cost.” Tyler Young Relativity Bro Snort Moloch The Hive In conclusion, there is no end to strengthening security at an organisation, and never a guarantee that a business is immune to cyber attacks despite best efforts. After all, businesses are made up of people and the element remains the weakest link in the game. Implementing the aforementioned security measures, however, provides a substantial relief and can deter hackers by a long shot for your business. human © 2020. ( ). All Rights Reserved. Ax Sharma Twitter Author’s Note: Thank you to all the businesses and experts from the security community who responded to requests for comment and interviews. I received over five dozen pitches, and while I regrettably couldn’t feature all of them, I sincerely thank everyone for their valuable time and insight.

Experts Warn: Amidst Budget Cuts, The Pandemic Calls for Stepping Up Security Efforts

As a freelance cloud architect, I spend my time reviewing and playing with the latest and greatest industry trends. Technologies like Kubernetes, ElasticSearch, and Prometheus fill my home and business infrastructure. After many hours of painful configuration and tweaking, they are now tuned to work exactly the way I want. I often want to re-sell this configuration to my clients in an effort to implement the cost savings of using technologies I’m comfortable with and on infrastructure I hold near and dear, in whatever cloud I have spun up for the day. This is usually a mix of my home-lab of on-premise servers as well as AWS EC2 instances. To this end, I often recommend similar configurations and setups for my projects. This then vendor-locks my clients into my own services, or they have to learn how to operate the infrastructure themselves if they want to break away at some point in the future. This last premise is one that I find myself looking at more and more as I visit communities of people who want to host web servers with some business logic, data APIs for game analytics, or even hosting their favorite Discord bots for fun. How would I market such an extravagant custom architecture to folks that shouldn’t be invested into such an intense solution? Is the upfront hosting cost going to pay dividends in the future? What about when the tides of change come through and a new technology stack paves the way? The simple answer is I don’t, and I shouldn’t. It’s not always the best solution to build a full infrastructure from the ground up. Sometimes a middle-tier Platform-as-a-Service (PaaS) is the right direction for these budding technologist products and growing applications. So I spent the day building a simple application using my own tools, and then ported it over to to test their levers, functionality, and learning curve. In this article, we will explore that simple application and compare it to my own technology stack to determine if it is a suitable alternative for my customers. Heroku The Application (Kubernetes) As initially noted, I will be using my infrastructure that I already have in place. This design is a scenario many architects would be familiar with and is the general go-to for applications I build with my clients. It comes complete with my chosen log collectors (fluentD and ElasticSearch), metrics observability (LinkerD), and ingress controllers (Ambassador) as a fabric for the application stack. For the application configuration see: https://github.com/Tokugero/kubernetes-hello-world Building the configs was as easy as taking my already-built yaml templates and updating them to fit this new app. Ambassador - Generate a LetsEncrypt certificate TLS.yaml Ambassador - Generate the ingress reverse proxy Mapping.yaml LinkerD - Annotations to inject the service mesh namespace.yaml On to the application! In order to give the most direct comparison, I wanted to require a database that I knew Heroku supported, so I chose Postgres. Setting up my own Postgres DB on Kubernetes was as simple as a with a few tweaks to its default to fit my infrastructure. Once this was up, I loaded a to have something to interact with. helm chart values test data set The was built using Flask and psycopg2 with its only purpose being to show data about what server it lived on and random rows in the Postgres database with some basic logging. It was built in a and pushed to a locally provisioned docker registry housed in my cluster. app container The effort of deploying this application to my cluster was relatively simple: kubectl apply -f namespace.yaml kubectl apply -f Mapping.yaml kubectl apply -f TLS.yaml helm install myapp -n myapp --values= stable/postgresql postgres/values.yaml kubectl exec <follow instructions to access new psql instance to input the > test data kubectl create secret generic psqlpass -n myapp --from-literal=PSQL_PASSWORD=”mydbpassword” kubectl apply -f Deployment.yaml In this image we see the grand result: an HTTPS encrypted web application showing some data from a backend. Here we can see the observability stack with Grafana exposing the ElasticSearch logs and the Prometheus metrics from LinkerD. In the configurations, the only prerequisite from the application owner is to annotate the namespace appropriately. Now, I have access to the following general operations commands: Scale: kubectl scale deployment -n myapp myapp --replicas=<n> Deploy: kubectl set image -n myapp deployment/myapp myapp=<new container image> The price tag to build and deploy this is $0. I have this running on my own hardware, and all the software used is open source. So the only real cost is my time and energy to manage and maintain the infrastructure. I also run a similar configuration in AWS that costs about $250/month for my cluster with three EC2 instances, a managed ElasticSearch cluster, and standard GP2 block-storage (SSDs). The Application (Heroku) I took this same application and followed Heroku’s intuitive UI to build the infrastructure for my application. Provisioning the PostgresDB was very easy. Simply navigating to the data app in the Heroku UI and selecting “Postgres” took me to a view that eventually showed my fully provisioned, free, DB with a few "free-tier" limitations to data and storage capacity. This came with a preconfigured DB name, user account, and auto-generated password with a host in AWS just for my DB. I can substitute my custom details for these provisioned ones via environment variables just like I could with Kubernetes. Deploying the app involved a bit more work. I needed to install the Heroku CLI to follow their Docker deployment methodology as well as a Postgres client to add data to the newly provisioned DB. This came down to using information that was output in the Postgres plugin details in my dashboard: heroku pg:psql postgresql-defined-xxxxx --app philip-myapp <add > test data heroku container:login <provide login details to heroku> heroku container:push web -a philip-myapp heroku container:release web -a philip-myapp After updating my environment variables, I was off to the races! Kind of. I still didn’t have metrics, and my app still wasn’t loading in the philip-myapp.herokuapp.com domain that was provisioned on my behalf. Navigating through the log viewer I found that the container was repeatedly crashing. It became clear to me that there wasn't a port mapping to define that 443 should go to my container’s 5000, and the app tried to repair itself by restarting when the Heroku health checks failed to reach my application. Some research led me to Heroku’s randomly provisioned port that is passed to the environment variable “$PORT”. I made a quick tweak to my to load this dynamically-assigned port, and my application finally started working. It even came with a provisioned DigiCert wildcard certificate. Dockerfile and myapp.py My running Heroku application: After making another small tweak to my configurations, I received a custom domain with my very own LetsEncrypt certificate: But this still isn’t quite feature parity. Where’s the observability and scaling? After poking around the configs, I found the problem: Metrics are only available to the “Hobby” tier dynos and above, which is $7/month. Scaling is only available to the “Pro” tier dynos and above at $25/month/dyno. Billing is prorated to the time used, however, so switching these settings was easy enough to get a feel for these features. The metrics were collected from the inception of the container which meant that I didn't lose any data before I switched to the “Hobby” dyno. Metrics With this done, these are my new functions to manage my application: To deploy, re-run the previous commands near the Dockerfile: heroku container:push web -a philip-myapp heroku container:release web -a philip-myapp To scale, simply upgrade to the “Pro” tier dyno and adjust the slider or use the CLI: heroku scale web=2 -a philip-myapp Scaling dynos... done, now running web at 2:Standard-1X And with only some mandatory scaffolding with the database naming conventions and port mapping functionality, I had an application with the same features that I enjoyed on my own Kubernetes clusters. The cost comparison between these two is vastly cheaper in Heroku’s favor when compared to my AWS cluster. However, it was clear that it would eventually become uneconomical if this application needed to grow to an enterprise-grade application. I believe that by the time it is necessary to maintain a scale of that size, however, it would also be time to optimize in other ways that may require a custom platform solution anyway. Conclusion Heroku surprised me in its capabilities and initial cost models. While it is an opinionated PaaS, its assertions on infrastructure are simple to understand and easy to collaborate with, while providing the same underlying functionality that makes me love the software-defined infrastructure of Kubernetes. My favorite part was Heroku’s use of industry standards like Docker and Git to manage their pipelines and deployments which made moving my application to their platform nearly an effortless exercise. It is features like these that help me trust them with my customer’s experience until a self-managed platform becomes necessary.

Heroku From the Perspective of a Cloud Architect

What is Certificate Transparency Required Error? It is one of the SSL errors which occurs when a user is trying to visit a secure website that is having an SSL certificate errors and which creates problem of connection between a user device and the remote server. The main reason for “Certificate Transparency Required Error” are as followed: The Certificate Authority hasn’t entered the website’s SSL Certificate to the Certificate Transparency log which may lead to fraud or negligence on the part of the Certificate Authority (CA’s). The owner of the website itself has notified the Certificate Authority not to enter the domain or any sub-domains to transparency log in order to keep certificate information private. Read Also: Monitor your HTTPS certificate expiry Certificate Transparency (CT) Implementation In March 2013, Google officially launched the first certificate transparency log. After few months, Digi Cert became the first Certificate Authority (CA) to implement Certificate Transparency. There after it was made compulsory to log the details of the issued SSL certificate in a CT logs. Certificate Transparency (CT) is an internet security standard that mandates the practice of maintaining public logs of all the digital certificates that are issued by trusted certificate authorities (CAs). Steps for how to Fix ERR_CERTIFICATE_TRANSPARENCY_REQUIRED Error Solutions for Website Visitors As this error is related to the incorrect SSL Certificate data, it can be solved through a website owner and not through a website user. But for a temporary basis, the user can fix this error using the below steps and can visit the said website. : Make sure you have installed the latest version of the Google Chrome. There was a bug in Chrome version 53, where it caused this error for Geo Trust, Symantec SSL Certificate. To update your Chrome Browser, go to the settings and click on About. On the click of about, it will look for the update. Update Google Chrome : Sometimes clearing the SSL Certificate cache of the browser can help in getting rid of Certificate Transparency Required or other related errors. Clear the SSL State Go to Internet properties on your browser Now Navigate to Content tab Clear your SSL State by clicking on the option Select Apply and then click OK button : This step isn’t recommended, though you can use it if none of the above steps aren’t working. Anti-Virus and firewall are sensitive to the SSL errors. For which you may get this kind of errors, to get rid of it you can always disable your antivirus program for a while in order to visit the website. Disable Firewall or Anti-Virus : Also Read How to Fix ERR_SSL_PROTOCOL_ERROR On Chrome Solution for Website Owner This is the only was through which this error can be resolved. The website owner needs to contact the Certificate Authority (CA) and inform about this issue. Tell them to add the website’s SSL Certificate to the CT log. Also check with the CA’s, regarding if there are any technical errors on CA’s behalf. If so, then reissue the SSL Certificate and reinstall it on your website. I know sometime install an SSL certificate is altogether a new challenge. There is an option to go for the Free and install the certificate without any hassle. SSL Installation on C-Panel If you still don’t get any proper response from your Certificate Authority (CA), then it is recommended to change your exiting CA with the reputed one like Digi Cert, Rapid SSL, Sectigo (Formerly Comodo), Geo Trust, etc. Conclusion:</h3> This error may not arise now with strict regulation from The Internet Engineering Task Force (IETF) as compulsory of Certificate Transparency Logs. Still it is advised to be aware about such errors, as it may occur at any given point. Hope we have helped you in resolving the Certificate Transparency Required Error.

Know how to Fix NET: ERR_CERTIFICATE_TRANSPARENCY_REQUIRED Error

Stories, News & Mentions about DIGICERT

Digicert’s Stories on HackerNoon