Securing web transactions TLS server certificate management

The internet has enabled rapid, seamless commerce across the globe.Billions of dollars' worth of transactions are performed across the internet every day.This is possible only because connections across the internet are trusted to be secure.Transport Layer Security (TLS), a cryptographic protocol, is fundamental to this trust.Organizations leverage TLS to provide the connection security that has enabled today's unprecedented levels of commerce across the internet.TLS, in turn, depends on TLS certificates.Organizations must deploy TLS certificates and corresponding private keys to their systems to provide them with unique identities that can be reliably authenticated.The TLS certificate enables anybody connecting to a system to know that they are sending their data to the site listed on the certificate.In addition, it also enables establishment of secure connections so that no one in the middle can eavesdrop on communications.Many organizations might be surprised to discover how many TLS certificates they have.A large-or medium-scale enterprise may have thousands or even tens of thousands, each identifying a specific server in their environment.This is because organizations use TLS not only to secure external connections between themselves and their customers over the internet but also to establish trust between different machines inside their own organization and thereby secure internal communications.Even though TLS certificates are critical to the security of both internet-facing and private web services, many organizations do not have the ability to centrally monitor and manage their certificates.Instead, certificate management tends to be spread across each of the different groups responsible for the various servers and systems in an organization.Central security teams struggle to make sure that certificates are being properly managed by each of these disparate groups.This lack of a central certificate management service puts the organization at risk because once certificates are deployed, they require regular monitoring and maintenance.Organizations that improperly manage their certificates risk system outages and security breaches, which can result in revenue loss, harm to reputation, and exposure of confidential data to attackers.The National Cybersecurity Center of Excellence (NCCoE) at the National Institute of Standards and Technology (NIST) built a laboratory environment to explore and develop guidelines to help large and medium enterprises better manage TLS server certificates by:  defining operational and security policies and identifying roles and responsibilities  establishing comprehensive certificate inventories and ownership tracking  conducting continuous monitoring of certificates' operational and security status  automating certificate management to minimize human error and maximize efficiency on a large scale  enabling rapid migration to new certificates and keys when certificate authorities or cryptographic mechanisms are found to be weak, compromised, or vulnerable This publication is available free of charge from: http://doi.org/10.6028/NIST.SP.