Recent Bank of Ireland outage, no SSL Certificate

Joe Public was seriously inconvenienced for about a day recently by the outage of Banking365, confronted with the message of no SSL Certificate. I think Joe Public deserves to know what might have happened.

For folk who no little or nothing I’ll put it simply that in order for safe encrypted transfers to take place between you, and the bank in this case, an SSL Certificate needs to be in place. For anyone curious, SSL stands for Secure Sockets Layer, and the secure bit is obvious to anyone. These need to be renewed periodically as things can change, this can be done through management software or a human being in the organisation. In any case a human would/should be overseeing that all this is in order.

For anyone interested encryption here works by a pair of keys, a public and private key, the pairing or handshake happens with every transaction you do through likes of Banking 365. Happens with your WhatsApp messages too, we are informed. Data cannot be seen without both keys, and the private key should be kept secret to the organisation’s system.

There are a number of possibilities of why a site, as happened with Banking365, displayed No SSL Cert. One is that the cert was let expire by lack of oversight, plain carelessness at a most basic level. Are we to believe BOI let this happen, by not having proper management of it in place on a software and human level? It’s possible.

Another possibility is that a human revoked the certified on an emergency basis because it got compromised, ie leaked out to a bad actor. This would be a serious matter with a lot of implications.

Third possibility is a malfunction of the software managing the certificate. A fourth possibility is someone purposefully revoked cert to take the site offline for sone reason unknown, like pulling the fuel cut off valve in an airline to stop the engine.

Anyone else have thoughts on this?