This Explains My Verisign Hits Yesterday

I was looking at my googles last night (due to Ed, Rocky, and Libby's posts reviewing theirs), and oddly enough there had been an unusual spike in google hits over the past two days. In the past 48 hours, I have gotten an amazing number of hits for "crl.verisign.com" in combination with a boatload of different other search words. Now I know why. See this CNET article about the expiration of Verisign's ICA certs, which occurred on Wednesday. I've written several articles about Verisign in the past, and I responded to a post about crl.verisign.com on Michael Braly's blog, and I've got that response linked in my Recent Responses block. This seems to have raised up my page rank on this subject, and a bunch of people who have been running into problems due to certificate expiration have found their way here.

So, if you're getting error messages or seeing unusual firewall activity regarding crl.verisign.com, first of all be aware that I'm not really an authority on this sort of stuff but I believe I do understand it pretty well and I am quite comfortable with saying that I don't think there are any security risks or any shenanigans on Verisign's part going on -- for a change. This is just one of those things that happens as a result of good security policies built into PKI, and administrators not keeping their systems up to date. If you want further info, read the CNET article, read the explanation from Verisign. read the instructions for updating your certificates from Verisign, and read instructions from IBM if you are a Domino admin, and finally read this explanation from RSA of what certificate revocation lists are.

Update: Another CNET article indicates that the expiration of the Verisign certs blew up Norton AntiVirus and through Norton it also blew up Word and Excel. The article also goes on to explain the connection between the certificate expiration and the certificate revocation lists on the crl.verisign.com server. Apparently the expiration of the certificates caused lots of software to fall into logic that checks for certicate revocation, overloading the crl server. Symantec has published a workaround for Norton AntiVirus users experiencing this problem.

Update 2Andy Oram blogged on the O'Reilly site, drawing an interesting parallel between the Verisign/Norton issue and monoculture issues. I can't agree, however, and I posted a response. As much as I wouldn't really mind having another reason to bash Verisign, this really could have happened to any CA that doesn't have adequate infrastructure. Oh wait ;-) It's a reason to bash Verisign after all ;-)

Update 3Now, here's The Register's story about the dead Verisign certificate.