Listen to this episode

Russian SSL and TLS Codes (Part 1)

0:0040:38

Recorded March 2022. Regulations, deadlines, requirements and products discussed in this episode reflect that date and may have changed since. For where things stand today, see our current compliance guidance or ask us.

The episode in brief

What this episode covers

In this episode of Encrypted Ambition, the Petronella Technology Group podcast, Craig, Erin, BJ and guest Blake discuss Russia introducing its own TLS certificates for SSL to bypass sanctions. Craig explains how TLS succeeded SSL, why websites buy certificates from trusted authorities such as GoDaddy, and how self-signed certificates lack third-party verification.

He argues Putin is circumventing sanctions by issuing Russian certificates. Blake reports that, at the time of recording, Chrome, Firefox and Edge would not accept the certificates and that Russia made them a legal requirement, while protesting the war could bring a 15-year prison sentence. The group debates whether cutting Russia off from Western resources is fair to its 140 million people; Craig contends the sanctions target Putin, not ordinary citizens. Erin calls the humanitarian toll sad while questioning alternatives to financially crippling Russia. Blake, joining from Tbilisi, Georgia, describes regional fear and recounts the Budapest memorandum and Crimea. The conversation widens into censorship, the undefined rules of cyber war, whether citizens can realistically overthrow their governments, and BJ's speculation that quantum computing and AI advances are driving world leaders to control internet infrastructure.

Worth remembering

Key takeaways

  1. Craig explains that TLS is the successor protocol to SSL and that proper configuration produces the padlock symbol and encrypts data exchanged with a website.
    “TLS stands for transport layer security, and it's the successor protocol to SSL or secure socket layer.”
  2. Buying certificates from a trusted third party matters because self-signed certificates are not verified by anyone as true and valid, Craig says.
    “Whereas if you self sign it, nobody is verifying that certificate to be true and valid.”
  3. Craig describes basic certificate applications asking for standard identity and company details, while extended verification requires documentation proving company ownership.
    “But at a basic level, they typically ask, normal questions like your first name, last name, your address the company name and the website URL.”
  4. Blake reports that, at the time of recording, Chrome, Firefox and Edge would not accept the Russian certificates, which could only be used through Russian alternatives.
    “So Chrome, Firefox and edge are not gonna allow these certificates to be issued.”
  5. Blake notes that, at the time of recording, Russia made the certificates a legal requirement, which he expects will push users onto Yandex browsers.
    “So they mandated these certificates. Like it's law that you have to use this, the certificate now.”
  6. Craig argues the sanctions are intended to pressure Putin rather than punish Russian citizens, who he hopes will benefit once sanctions are lifted.
    “the sanctions are put in place, not necessarily to punish the people, but to punish the leader of the country”
  7. BJ speculates that a rush to create separate national internets and certificates is driven by fear that quantum computing puts leaders' control at risk.
    “That's all this huge rush now because quantum computing has sparked fear in their hearts because now they feel like they're controlling their power might be at risk.”

The summary and takeaways were drafted with AI from the transcript below. Each takeaway is shown with the passage it comes from.

Full text

Episode transcript

Select any timestamp to play from that moment. This transcript was generated automatically from the audio and may contain errors, including in speaker names. The audio is the record.

Encrypted Ambition

Never miss an episode

New conversations on cybersecurity, compliance and AI for business leaders. Follow the show, or talk to Petronella Technology Group about what you heard.