SSL broken, again, in POODLE attack

Yet another flaw could prove to be the final nail in SSLv3's coffin.

Read the whole story

 

[afidel]

So I've got another thing to hand of to my team while I'm out of town this week =)
Luckily I think we can just change the GPO for the IT testing computers and if nothing breaks for a few days roll it out to the whole company, I'll have to check if the GPO enabled version of Firefox we use has an option for disabling SSLv3, it's really only used for one internal app, but it's better to be thorough.

 

[afidel]

dooferorg[/url]":2p3z1zji]As well as SSL3 needing to go there's the phasing out of SHA1 too.

Certificates will likely need to be re-signed and webservers reconfigured soon.

SHA1 certs can't be renewed past 12/31/2016, we recently renewed our wildcard cert and since the expiry was in 2017 it was issued as SHA2, we had to have them generate a copy as SHA1 as Citric Secure Gateway can't deal with SHA2 but it's set to expire before the main cert.