One million SSL certificates still using “insecure” SHA-1 algorithm

Nearly a million SSL certificates found in Netcraft's October SSL Survey were signed with the potentially vulnerable SHA-1 hashing algorithm, and some certificate authorities are continuing to issue more. Google Chrome already regards these certificates as insecure, resulting in more warning signals than if the sites had been served over a completely unencrypted HTTP connection.

The latest research, dubbed the SHAppening, shows that these warnings are well founded, projecting that a full SHA-1 collision could be found within 49-78 days on a 512-GPU cluster. Renting the equivalent processing time on Amazon's EC2 cloud computing service would cost only $75k-$120k, which is an order of magnitude less than earlier estimates. The researchers point out that this represents an important alarm signal, and that the industry's plans to move away from SHA-1 by 2017 might not be fast enough.

The researchers consider that is now feasible [pdf] for a well funded attacker to impersonate an SSL site that uses a publicly trusted SHA-1 certificate. Worse still, while browsers still accept SHA-1 signatures, SSL sites remain at risk even after migrating to SHA-2: if an attacker were to compromise an intermediate CA certificate signed with SHA-1, he could generate valid certificates for arbitrary domains.

The SHA-2 and SHA-3 family of cryptographic hash algorithms are now the only ones approved by the National Institute of Standards and Technology (NIST) for digital signature generation. Although the SHA-2 family includes SHA-224, only the stronger SHA-256, SHA-384 and SHA-512 algorithms are allowed by the CA/Browser Forum's Baseline Requirements for the issuance and management of publicly-trusted certificates.

These newer algorithms do not exhibit the mathematical weaknesses of SHA-1, and also generate longer digests than the 160-bits computed by SHA-1. Almost all new SHA-2 subscriber certificates use SHA-256 (99.99%), while only a handful use SHA-384 and SHA-512. Most of the latter are issued by DigiCert.

The rise of SHA-2

Migration to SHA-2 slowly gathered pace when the National Institute of Standards and Technology (NIST) banned the use of SHA-1 for new signature generation after the end of December 2013, but the rate of growth increased in the wake of the 2014 HeartBleed bug. This bug resulted in around half a million certificates being potentially compromised, requiring urgent reissuance and revocation. By this time, many certificate authorities were already using SHA-256 for new certificates, which in turn caused a significant boost in the number of SHA-2 certificates in use on the web.

SHA-1 vs SHA-2 (source: Netcraft SSL Survey October 2015)

SHA-1 vs SHA-2 (source: Netcraft SSL Survey October 2015)

SHA-2 eventually overtook SHA-1 in May 2015, but there are still nearly a million certificates currently using SHA-1.

The use of SHA-1 in new certificates is expected to halt by the close of this year, as from 2016, the CA/Browser Forum Baseline Requirements will forbid the issuance of any new subscriber certificates or subordinate certificates that use the SHA-1 algorithm.

However, with less than three months to go, Symantec proposed a motion (endorsed by Entrust, Microsoft and Trend Micro) to allow the issuance of SHA-1 signed certificates throughout 2016. The proposed changes to the Baseline Requirements would have catered for "a very small number of very large enterprise customers" who are unable to migrate to SHA-2 before the end of this year. But with the new cost projections making the risk of a real-world attack higher than previously believed, Symantec and the endorsers subsequently withdrew the ballot on 12 October.

Even if this ballot were accepted, many certificate authorities have already decided to avoid using SHA-1 because of the way some browsers will treat these certificates. For example, if an existing SHA-1 certificate is due to expire during 2016, Google Chrome currently flags this up as a weak security configuration and warns the user that their connection may not be private. Certificates that are valid until 2017 or later are treated as affirmatively insecure, with the "https" protocol crossed out.

Weak and insecure certificates

Despite being regarded as weak or insecure by one of the most commonly used browsers, over 120,000 of the SHA-1 certificates currently in use on the web were issued during 2015, and 3,900 of these have expiry dates beyond the start of 2017. The owners of these certificates will undoubtedly need to replace them months — or in some cases, years — before they are due to expire.

For example, Deloitte is still using a SHA-1 signed certificate that was issued in February 2015 and valid until 2020. Google Chrome already regards this certificate as insecure:


This SHA-1 certificate was issued by A-Trust Gesellschaft für Sicherheitssysteme im elektronischen Datenverkehr GmbH, who operate the A-Trust-nQual-03 root certificate that is trusted by all mainstream browsers.

In February 2014, when Netcraft first published a look at SHA-2 migration, more than 256,000 SHA-1 signed certificates would have been valid beyond the start of 2017. Despite the browser vendors' deprecation plans, this total is roughly the same today.

Buggy browsers treating some SHA-2 certificates as insecure

Some certificate authorities were hit by an unexpected pitfall after migrating to SHA-2, after failing to use new names for their SHA-2 signed intermediate certificates. SSLMate, an SSL certificate vendor, published two examples of how Google Chrome could erroneously suggest that a site was affirmatively insecure for serving a SHA-1 certificate, even when the full certificate chain actually used the SHA-2 hashing algorithm. This undesirable behaviour was caused by caching in the cryptographic libraries used by Chrome (CryptoAPI on Windows, and NSS on Linux).

When a CA migrates to SHA-2, it can either reuse an existing intermediate certificate by re-signing the existing public key with SHA-2, or it can generate a new one with a new public key and subject name. If the existing certificate is reused, some Windows browsers will end up ignoring the chain provided by the server and instead use the old SHA-1 intermediate certificate if it has been cached previously. This will cause Chrome to believe that the connection to the site is affirmatively insecure.

SSLMate observed that StartCom was still issuing SHA-2 certificates that were signed by a SHA-1 intermediate, despite CA/Browser Forum Ballot 118 stating that CAs should not do this. Netcraft's SSL Survey also shows the same mistakes being made by other certificate authorities, including WoSign, Entrust and Unizeto amongst others. All of these certificates may be regarded as insecure by the Chrome browser.

The second example involved a bug in older versions of NSS on Linux, which could cause Chrome to use a cross-signed root even if a shorter and newer chain exists. If the cached cross-signed certificate uses SHA-1, Chrome will consider the chain to be weak, even though the server may have sent a chain that used SHA-2 throughout.

October 2015 Web Server Survey

In the October 2015 survey we received responses from 878,269,546 sites and 5,491,917 web-facing computers. This reflects a drop of 14.5 million sites since last month, while the number of computers rose by 53,800.

nginx grew in all metrics this month – websites, active sites, web-facing computers, and its share of the top million sites. With a gain of 866,000 active sites, nginx has increased its market share in this metric beyond 15% for the first time.

nginx also made an impressive gain of 21,480 web-facing computers, outpacing Apache's increase of 12,629 and Microsoft's 4,606. nginx is now used by 727,000 web-facing computers around the world, but it still has a fair way to go before it encroaches on the dominance of Microsoft and Apache. More than twice as many computers are running Microsoft server software, while Apache is even further ahead with its 2.5 million computers giving it a 46% share of the market.

Increasing native support for HTTP/2

The latest mainline version of nginx (1.9.5) has ditched support for SPDY, replacing it with HTTP/2 via an experimental ngx_http_v2_module. The latest major release in the 2.4 stable branch of Apache also now supports HTTP/2 natively. Apache 2.4.17 was released on 13 October 2015, and includes a donated HTTP/2 implementation in the mod_http2 core module, which has similar configuration options to the existing mod_ssl module. HTTP/2 support was previously available since Apache 2.4.12 via the mod_h2 module, although this required the server source code to be patched.

HTTP/2 is the standardised successor of SPDY, on which it was based. The primary motivation for using either of these protocols is performance – compared with HTTP 1.1, both of the newer protocols offer reduced latency through methods like header compression, prioritisation, and allowing webpage elements to be requested in parallel over a single TCP connection.

However, widespread use of HTTP 1.1 is likely to continue for several more years at least, as most browser vendors only support HTTP/2 over encrypted TLS connections. This means the significantly greater number of non-HTTPS sites currently in existence will carry on using HTTP 1.1, even though the HTTP/2 standard is also defined for HTTP URLs.

Despite the potential performance benefits, less than 5% of all SSL certificates in Netcraft's October SSL Survey were found on web servers that supported SPDY or HTTP/2. However, 29% of SSL sites within the thousand most popular sites currently support SPDY or HTTP/2, while 8% of those within the top million sites do. The busiest sites have the most to gain by optimising their connections, so this distribution is not too surprising.

HTTP/2 is also supported by the latest version of Microsoft Internet Information Services, although with the production version of Windows Server 2016 yet to be released, it is not too surprising that IIS 10.0 was found being used by only 2,200 sites in this month's survey. Several of these sites are hosted by Microsoft, and although publicly accessible, the hostnames suggest they are test servers that mirror the functionality of existing Microsoft sites still running IIS 7.0 and IIS 7.5.

While Windows Server 2016 is likely to become the primary platform for IIS 10.0 on the internet, IIS 10.0 is also included in Windows 10, which is already available and has been offered as a free upgrade to many Windows users. Technical Preview versions of Windows Server 2016 are also currently available for evaluation. Some earlier versions of Windows, including Windows 7 Service Pack 1, can also run IIS 10.0 Express. This is a self-contained version that has all of the core capabilities of IIS 10.0, as well as some additional features to make it easier to develop and test websites.

Total number of websites

Web server market share

DeveloperSeptember 2015PercentOctober 2015PercentChange
Continue reading

Fraudsters use OV certificate for phishing

In June 2015, Trustwave issued an organisation-validated certificate for, and that was used on a PayPal phishing site. The certificate was issued to an individual in India, Asha Shaikh, who may be the fraudster behind the phishing site, or perhaps one of the fraudster's victims. The phishing attack is now offline, but the certificate has yet to be revoked by Trustwave at the time of writing.

Rendered contents of phishing site found on The error message visible at the top of the page is a giveaway: the geo-location of the visitor's IP address failed, and it reveals the location of the files used to power the phishing site.

Certificate authorities typically sell certificates in three broad categories of assurance: domain-validated certificates simply validate control over a domain name; organisation-validated certificates include the identity of the organisation; and Extended Validation certificates increase the level of identity checking done to meet a recognised industry standard.

The difference between DV, OV, and EV certificates is sometimes subtle — many sources of consumer advice do not make the distinction between certificates that provide further identity information and those that only validate domain name ownership. For example, Google Chrome's help page states: "You can tell if a site is real if it has a valid TLS/SSL certificate".

Most certificates with deceptive domain names are domain-validated, though some appear to be organisation-validated. Many of the SSL certificates associated with CloudFlare's "Universal SSL" programme are ostensibly organisation-validated; however, the organisation being validated in this case is CloudFlare itself and not each individual customer. certificate

An organisation-validated certificate for shown in the Windows certificate viewer.

Rather than be processed automatically, as is possible with domain-validated certificates, most higher-assurance certificate requests will be reviewed by a human prior to issuance. This additional level of validation makes it all the more surprising that a request for a certificate containing "paypal" wasn't considered a high risk request, and consequently rejected after being subjected to increased scrutiny.

Trustwave offers a Relying Party warranty with its certificates, covering fraudulent credit card charges made by a Trustwave certificate holder. However, the warranty does not cover other types of fraud, meaning phishing for credentials or fraudulent payments using other payment methods are not covered. As a result, victims of this phishing attack will not be able to claim on this warranty, despite having their PayPal credentials stolen by a fraudster using a Trustwave certificate.

Certificate authorities issue SSL certificates to fraudsters

In just one month, certificate authorities have issued hundreds of SSL certificates for deceptive domain names used in phishing attacks. SSL certificates lend an additional air of authenticity to phishing sites, causing the victims' browsers to display a padlock icon to indicate a secure connection. Despite industry requirements for increased vetting of high-risk requests, many fraudsters slip through the net, obtaining SSL certificates for domain names such as (issued by Comodo), (issued by Symantec), and (issued by GoDaddy).

CloudFlare, a content delivery network that provides free "Universal SSL" to its customers, is a hotspot for deceptive certificates, accounting for 40% of SSL certificates used by phishing attacks with deceptive domain names during August 2015. CloudFlare's Universal SSL certificates are provided in partnership with Comodo, and CloudFlare also use GlobalSign certificates for some of its customers. CloudFlare's flexible SSL option also appeals to fraudsters, offering a padlock in victims' browsers without the need for attackers to set up SSL on their web servers.

PayPal phishing site

A screenshot of a PayPal phishing site using a widely trusted SSL certificate valid for The certificate is a CloudFlare Universal SSL certificate issued by Comodo. The certificate has not been revoked; however, the phishing site is no longer available.

Websites that use TLS (the successor to SSL) are marketed as being trustworthy and operated by legitimate organisations. Consumers have been trained to "look for the padlock" in their browser before submitting sensitive information to websites, such as passwords and credit card numbers. While the reality is more nuanced, the data submitted to a phishing site using TLS is protected from eavesdroppers. However, a displayed padlock alone does not imply that a site using TLS can be trusted, or is operated by a legitimate organisation.

NatWest phishing site

A screenshot of a NatWest phishing site using a widely trusted SSL certificate valid for (nwolb stands for NatWest online banking. The legitimate NatWest online banking service is available at

Bank of America phishing site

A screenshot of a Bank of America phishing site using a widely trusted SSL certificate valid for

The following table lists some examples of deceptive SSL certificates that have been used to conduct phishing attacks, along with their Domain Registration Risk scores:

Hostname Phishing Target Certificate Authority Assurance Risk Score Revoked Halifax GlobalSign (CloudFlare) OV* 10.0 No PayPal Comodo (CloudFlare) OV* 9.17 Yes
blockchaí ( Blockchain GlobalSign (CloudFlare) OV* 8.52 No Blockchain Comodo DV 8.42 No Apple iTunes Symantec DV 8.08 No PayPal Symantec DV 6.61 No BT GoDaddy DV 5.56 Yes

* The certificates that CloudFlare issues to its customers are ostensibly organisation-validated, as they contain CloudFlare's company name and address. However, the customer domains themselves are only domain-validated.

The CA/Browser Forum's Baseline Requirements – a set of rules that publicly-trusted certificate authorities are expected to follow – require that high-risk domain names that may be used for fraud or phishing are subjected to additional verification:

High Risk Certificate Request: A Request that the CA flags for additional scrutiny by reference to internal criteria and databases maintained by the CA, which may include names at higher risk for phishing or other fraudulent usage.
The CA SHALL develop, maintain, and implement documented procedures that identify and require additional verification activity for High Risk Certificate Requests prior to the Certificate’s approval.

Despite this requirement, many major certificate authorities issue SSL certificates for deceptive domains used in phishing attacks. Notable exceptions include DigiCert and Entrust, neither of which issue domain-validated certificates.

A pie chart showing SSL certificates containing a deceptive domain name that were used in phishing attacks during August 2015, split by certificate authority. CloudFlare and non-CloudFlare certificates are shown separately.

Certificate authorities commonly provide SSL certificates at three different levels of assurance:

  • Domain validated (DV)
    Certificate authorities only have to check that the certificate's applicant controls the domain name contained in a DV certificate. These certificates are typically the cheapest option, and can be had for free or be purchased for less than $10. Let's Encrypt is planning to offer free, automatically-issued DV certificates starting later in 2015.
  • Organisation validated (OV)
    In addition to validating the domain name in the certificate, the identity of the person or organisation applying for an OV certificate is also verified by the certificate authority and included in the certificate. Most browsers do not treat OV certificates any differently to DV certificates.
  • Extended validation (EV)
    Like OV certificates, the identity of the organisation applying for an EV certificate is verified by the certificate authority. However, the verification is more stringent. EV certificates also receive different treatment in major web browsers – the address bar is either partially or completely coloured green and the requesting organisation's name and country are displayed next to the padlock. The requirements for EV certificates in Chrome are changing, with many certificate authorities caught out by recent changes to require Certificate Transparency.

The requirement to perform additional verification of high risk certificate requests applies to all levels of assurance. However, DV certificates are often issued completely automatically within minutes, making it easy for fraudsters to obtain DV certificates for deceptive domain names.

Several certificate authorities offer free trial certificates with shorter validity periods. For example, Comodo offers free 90 day certificates, which have been used by a number of SSL phishing attacks. Symantec also offers free 30 day certificates through its GeoTrust brand. The short validity periods are ideal for fraudsters as phishing attacks themselves typically have short lifetimes.

Netcraft's Domain Registration Risk service automatically identifies deceptive domain names constructed using such tricks. The service calculates a risk score between 0 (low risk) and 10 (high risk) for each domain name, which represents the likelihood that the domain name will be used to carry out a phishing attack. Certificate authorities can make use of the service to determine if a domain name is likely to be used for fraudulent purposes before issuing the certificate.

The service can be provided as an API that mimics a Certificate Transparency log server for ease of integration with your existing certificate issuance process. The same API can also be used with Netcraft's certificate compliance checking service, which can identify certificates before they are issued that do not conform with the CA/B Forum's Baseline Requirements or its EV Guidelines.

Most Reliable Hosting Company Sites in September 2015

Rank Performance Graph OS Outage
DNS Connect First
1 Inc Linux 0:00:00 0.000 0.256 0.008 0.019 0.019
2 Datapipe Linux 0:00:00 0.004 0.164 0.012 0.025 0.032
3 Qube Managed Services Linux 0:00:00 0.004 0.150 0.044 0.089 0.089
4 XILO Communications Ltd. Linux 0:00:00 0.009 0.224 0.064 0.128 0.129
5 Memset Linux 0:00:00 0.013 0.159 0.065 0.158 0.248
6 EveryCity SmartOS 0:00:00 0.018 0.100 0.067 0.133 0.134
7 Anexia Linux 0:00:00 0.018 0.191 0.086 0.174 0.174
8 Pickaweb Linux 0:00:00 0.026 0.305 0.010 0.168 0.169
9 Hyve Managed Hosting Linux 0:00:00 0.031 0.110 0.063 0.127 0.128
10 Pair Networks FreeBSD 0:00:00 0.031 0.241 0.070 0.141 0.141

See full table

For the second month in a row, GoDaddy had the most reliable hosting company website. Throughout September, it was the only company to respond to all of Netcraft's requests, with an average connection time of only 8 milliseconds. This is the fifth time this year that GoDaddy has been in the top ten.

GoDaddy recently added new features to its GoDaddy Pro programme, which has grown to more than 50,000 members since its launch in June. Aimed at web designers and developers, it allows members to manage clients and clients' products, offering discounts of at least 30%.

Datapipe had the second most reliable hosting company website in September, with just a single failed request. Datapipe came first in July, and August was the only month so far this year when it was absent from the top ten.

On 9 September 2015, Datapipe announced that it had acquired DualSpark – an Amazon Web Services assessment, automation and migration company, which was founded by former AWS managers. Datapipe hopes to use DualSpark's DevOps and automation expertise to bring increased levels of support to its cloud clients.

Qube Managed Services ranked third in September, also with only one failed request, but with a marginally longer average connection time than Datapipe. Qube's site has appeared in the top ten for all but two months so far in 2015, making this its seventh appearance.

Linux dominates the chart this month, being used by eight of the top ten sites, and all of the top five. EveryCity uses the SmartOS community fork of OpenSolaris, while Pair Networks uses the FreeBSD operating system. This is the third month in a row where Microsoft Windows has been completely absent from the top ten.

Netcraft measures and makes available the response times of around forty leading hosting providers' sites. The performance measurements are made at fifteen minute intervals from separate points around the internet, and averages are calculated over the immediately preceding 24 hour period.

From a customer's point of view, the percentage of failed requests is more pertinent than outages on hosting companies' own sites, as this gives a pointer to reliability of routing, and this is why we choose to rank our table by fewest failed requests, rather than shortest periods of outage. In the event the number of failed requests are equal then sites are ranked by average connection times.

Information on the measurement process and current measurements is available.

eBay phishing sites hosted by… eBay

Fraudsters are stealing eBay usernames and passwords using phishing pages hosted on eBay's own infrastructure. One of these pages, targeting German users, is shown below:

An eBay phishing form hosted on eBay's own infrastructure. The form contents are submitted to an external domain in Russia.

An eBay phishing form hosted on eBay's own infrastructure. The form contents are submitted to an external domain in Russia.

The convincing appearance of the spoof login form is bolstered by the fact that it is hosted on a genuine eBay domain, This domain is ordinarily used to host descriptions for eBay listings which are displayed within iframes on eBay listing pages.

In this case, the corresponding eBay listing has already been deleted, although the phishing content within the listing's description can still be viewed by browsing directly to the relevant URL on Consequently, the attack is still live and capable of stealing credentials from eBay users.

The URL of the credential-stealing script is only momentarily visible in the address bar before the victim is redirected to the genuine eBay site.

The URL of the credential-stealing script is only momentarily visible in the address bar before the victim is redirected to the genuine eBay site.

When a victim enters his username and password into the form, both values are submitted to a PHP script hosted on a server in Russia. After stealing the credentials, this script then redirects the victim to the genuine login page, which reports that the username or password was incorrect.

After the victim's credentials are stolen, he is redirected to the real eBay login page. Note that the username field has been automatically populated with the username stolen by the fraudster.

After the victim's credentials are stolen, he is redirected to the real eBay login page. Note that the username field has been automatically populated with the username stolen by the fraudster.

This error message might cause the victim to become suspicious enough to look at the browser's address bar, to check he is on the right website; but it will already be too late at this point – his credentials will have already been stolen, and because his browser will now be showing in the address bar, he may not even realise that his credentials have just been sent to a web server in Russia. There is consequently little chance of the victim reacting by changing his password, allowing the fraudster to take full advantage of the stolen credentials at his leisure.

The website involved in collecting the stolen credentials has also been used to host other phishing attacks targeting German-speaking consumers, including sites impersonating PayPal, Apple, and

In an attempt to evade detection by eBay and others, the fraudster has obfuscated the HTML source of his eBay phishing form. This makes it impossible to find such a listing by searching for any of the words that appear in the description, yet the rendered results appear as normal when viewed in a web browser.

The obfuscated HTML source used by the phishing content hosted by eBay.

The obfuscated HTML source used by the phishing content hosted by eBay.

Allowing anyone to insert arbitrary HTML and malicious scripts into a listing's description gives plentiful opportunities to would-be fraudsters, particularly as this weakness has been exploited to carry out similar attacks against eBay users in the past. Last year, Netcraft reported on fraudsters injecting malicious JavaScript into eBay listings to set up man-in-the-middle attacks against car buyers, and similar JavaScript redirection techniques have continued to be exploited throughout 2015.

These phishing methods can be much more successful than traditional phishing attacks (where content is hosted solely on an unrelated domain). The techniques employed in these latest attacks are not permitted under eBay's HTML and JavaScript policy; however, a fraudster intent on stealing passwords is not going to be deterred by words alone.