<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;"><div><div>I actually presented a webinar (damn I hate that word) yesterday talking about SHA1 migration and gTLD issues for certificates. A recording is up on BrightTalk <a href="https://www.brighttalk.com/webcast/10589/154561">https://www.brighttalk.com/webcast/10589/154561</a></div><div><br></div><div>Everyone should be moving to SHA256 but the UI degradation only displays for certs with that are SHA1 and valid after 01-JAN-16. </div><div><br></div><div>This leaves a fairly big window to change out certs. Anyone with Symantec, certs that are SHA1 and valid after 01-JAN-16 can replace them for free with SHA2 certs.</div><div><br></div><div>TLS 1.0 needs to go. Yesterday.</div><div><br></div><div><p class="MsoNormal" style="margin: 0cm 0cm 0.0001pt;"><span lang="EN-US">Nick.<o:p></o:p></span></p><p class="MsoNormal" style="margin: 0cm 0cm 0.0001pt;"><span lang="EN-US"> </span></p><p class="MsoNormal" style="margin: 0cm 0cm 0.0001pt;"><span lang="EN-US">-------------------------------------------------------<o:p></o:p></span></p><p class="MsoNormal" style="margin: 0cm 0cm 0.0001pt;"><span lang="EN-US">Nick Savvides, </span>Senior Principal Systems Engineer (Security)</p><p class="MsoNormal" style="margin: 0cm 0cm 0.0001pt;"><span lang="EN-US"><span style="color: blue; "><a href="mailto:nick_savvides@symantec.com" style="color: purple; ">nick_savvides@symantec.com</a>, </span></span>Mobile: +61 434 600 870</p></div></div><div><br></div><span id="OLK_SRC_BODY_SECTION"><div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt"><span style="font-weight:bold">From: </span> Matthew Moyle-Croft <<a href="mailto:mmc@mmc.com.au">mmc@mmc.com.au</a>><br><span style="font-weight:bold">Date: </span> Friday, 26 June 2015 08:14 <br><span style="font-weight:bold">To: </span> "<a href="mailto:ausnog@ausnog.net">ausnog@ausnog.net</a>" <<a href="mailto:ausnog@ausnog.net">ausnog@ausnog.net</a>><br><span style="font-weight:bold">Subject: </span> [AusNOG] AU Major Banks and SHA-1<br></div><div><br></div><div dir="ltr"><div>We've all been distracted by the large scale crazy of site blocking, meta data retention and whatever else the Australian Government is doing.</div><div><br></div><div>But need to focus on some basics:</div><div><br></div><div>SHA-1 is on it's way out (see <a href="http://googleonlinesecurity.blogspot.com/2014/09/gradually-sunsetting-sha-1.html">http://googleonlinesecurity.blogspot.com/2014/09/gradually-sunsetting-sha-1.html</a>).<br></div><div><br></div><div>Friend got a warning for his bank (not Australian) from Chrome about bad SSL configs, so I went and had a quick look at the big 4 banks in Australia to see what's up.</div><div><br></div><div>Commbank - got it right - no SHA-1 for home page or Internet Banking, no TLS 1.0</div><div>ANZ - no SSL on home page, TLS 1.0 and SHA-1 for internet banking (oh boy!)</div><div>NAB - no SSL on home page, TLS 1.2 and SHA-1 for internet banking</div><div>Westpac - no SSL on home page, TLS 1.2 and SHA-1 for internet banking</div><div><br></div><div>Anyone here who can influence good internet crypto for the 3 that aren't quite there? </div><div><br></div><div>MMC</div></div></span></body></html>