Topic Keywords: SSL/TLS
It is believed that increased computing power will make the commonly used 1024-bit keys possible to break by 2011. There is a side effect in switching to the larger keys that some old web browsers don’t support > 1024 bit keys. I can’t find a good reference that tells me which versions of which browsers, but this is something to keep in mind.
We’ve rebuilt the NowSMS SSL library to generate 2048 bit keys when generating a new certificate signing request (CSR). An update can be downloaded at
https://nowsms.com/download/smsssl.zip.To install the update, stop the NowSMS services and exit NowSMS.
Unfortunately, the change to 2048 bit key requirements will cause problems for renewals for customers that already have an SSL certificate signed by a certificate authority (CA).
When your renewal time comes up, many CAs will not renew your certificate until you switch to a 2048 bit key.
However, if you generate a new server certificate request with NowSMS, this forces the existing certificate to be immediately invalidated, which may cause problems for existing clients during the certificate renewal process.
(This problem is not specific to NowSMS … many web server administrators are facing similar problems.)If you face this renewal issue with NowSMS, follow this procedure:
- Locate and backup the following NowSMS files (in either Program Files\NowSMS for Windows XP/2003 or ProgramData\NowSMS for Windows Vista/7/2008):
SSL.CRT
SSL.CSR
SSL.CA
SSL.INI
SSL.KEY - On the “SSL/TLS” page of NowSMS, select the option to “Generate Server Certificate”.
- You will be warned that doing this will invalidate your existing certificate. If you have backed up the files that I mentioned above, select “Yes” to continue.
- After the new certificate signing request has been generated, copy the new versions of SSL.CRT, SSL.CSR, SSL.INI and SSL.KEY to a different location for backup. (Note: There will not be an SSL.CA file as this file will not exist until you get your signed certificate back from the CA.)
- Put the old backup copies of these files, including SSL.CA, back in the appropriate NowSMS directory.
- Use the new SSL.CSR to request a signed certificate from your CA. When you get the signed certificate back from the CA, save it as SSL.CA.
- Copy the new version of these files, including SSL.CA to the appropriate NowSMS directory and restart the NowSMS services.
For comments and further discussion, please click here to visit the NowSMS Technical Forums (Discussion Board)...
One Response to “NowSMS and SSL Certificates – 2048 Bit Key”
Note: The SSL update has been rolled into the lastest NowSMS update. For more information, please see http://blog.nowsms.com/2010/05/nowsms-update-interim-release-20100507.html