SA Post Office website security certificate problems

[Kevin Lancaster]

SA Post Office website security certificate problems

The South African Post Office’s website is struggling with a certificate problem, which is frustrating many users.

 

[chopsky]

Their SSL has been screwed for aaages. Super ironic, since they sell SSL certificates via trustcentre.co.za and even that SSL isn't properly installed/issued. What a balls up.

 

[skeptic_SA]

But lets make them responsible for billions in social grants. What could go wrong?

 

[mr.B]

This is a much better site to test your servers SSL - https://www.ssllabs.com/ssltest/analyze.html?d=www.postoffice.co.za

 

[macarbiter]

This is a much better site to test your servers SSL - https://www.ssllabs.com/ssltest/analyze.html?d=www.postoffice.co.za

Was just about to say the same thing.

Other than the untrusted CA certificate, there are too many other problems, worst of which is that they still support SSLv3 and that their preferred cipher is RC4, which has been considered insecure for a while now.

 

[Hunted]

Their SSL has been screwed for aaages. Super ironic, since they sell SSL certificates via trustcentre.co.za and even that SSL isn't properly installed/issued. What a balls up.

Agree, this has been going on a long time already.

 

[mister]

Their SSL has been screwed for aaages. Super ironic, since they sell SSL certificates via trustcentre.co.za and even that SSL isn't properly installed/issued. What a balls up.

yep, its been borked for freaking months and months

 

[j4ck455]

Issuer: SAPO SSL CA

The certificates are issued by the SA Post Office’s Trust Centre, which is accredited by the South African Accreditation Authority, in terms of the Electronic Communications and Transactions Act.

So government thought it could pass a law in SA that forces "the Internet" to trust SAPO as its own CA?

Well there's the problem.

 

[¯\_(ツ)_/¯]

The certificates are issued by the SA Post Office’s Trust Centre, which is accredited by the South African Accreditation Authority, in terms of the Electronic Communications and Transactions Act.

Is this the same SAAA that had a DHL phish sitting on their servers for so many months, not seeing the obvious, ignoring alerts?
https://www.infosecurity-magazine.com/news/dhl-customers-phished-using-south/

Yes, we should trust these guys, ensuring your security by decree ....

 

[j4ck455]

SAPO runs another site ironically called "TrustCentre" that is linked to from the SAAA site:

http://www.saaa.gov.za/index.php/accredited-authentication-and-certification-products-services.html

As with the SAPO site, the TrustCentre site is also not trusted by browsers.

 

[initroot]

And expired again...

 

[FiestaST]

I miss the old staff logo.

 

[DapperDanMan]

This is a much better site to test your servers SSL - https://www.ssllabs.com/ssltest/analyze.html

Oh no ... it looks like we are just second-class citizens/netizens.