SSL is a protocol that encrypts and securely transmits data between servers and browsers. The electronic file that this protocol enables is called an SSL certificate, and by installing the SSL certificate on the server, secure communication using the SSL protocol is possible also the company can be identified through the name of the company inside the certificate.

SSL certificates can be issued up to one year since September 2020, and are not automatically renewed, so one has to reissue and install the certificate in time for the renewal date every year.

If the missed renewal period and it expired, information entered in the browser may be exposed to potential hackers. Most of all, the vulnerability of the website’s security settings and the situation in which the service is not operating properly are exposed, resulting in fatal damage to the user trust of the website and service provider.

For example, Spotify, the world’s largest music streaming site, recently received strong criticism from users for missing the renewal period of the certificate and not providing the service normally.

If you use the filter ssl_expired in Asset Search on Criminal IP (https://www.criminalip.io), you can check whether the SSL certificate on the internet page has expired or not.

Search Keyword: “ssl_expired: true”

Using the 'ssl_expired: true' filter, more than 11 million web pages with expired SSL certificates were found

Using the ‘ssl_expired: true’ filter, more than 11 million web pages with expired SSL certificates were found

 

This Screen shows the website where the SSL certificate has expired and undermines the credibility of the website

This Screen shows the website where the SSL certificate has expired and undermines the credibility of the website

 

Search Expired SSL Certificates Using Additional AS Name and HTML filter

If you add a filter called ‘as_name’ to the Search results filter above, you can narrow down the web pages that have expired SSL certificates by a specific company.

Search Keyword: “as_name: Spotify ssl_expired: true”

Among the web browsers operated by Spotify, 7 pages can be identified expired SSL certificates

Among the web browsers operated by Spotify, 7 pages can be identified expired SSL certificates

 

We’ve also looked at web pages with expired SSL certificates, including sites that provide VPN services for IKEA, another famous multinational company.

Search Keyword: “as_name: IKEA IT AB ssl_expired: true”

Website providing VPN service owned by IKEA found by searching for ‘as_name: Ikea IT AB ssl_expired: true’

 

Moreover, if a web browser that collects user’s information through a login function is in a status where the certificate has expired, there is a possibility that the user’s personal information can be leaked by a hacking attack. This can cause the worst damage to both service operating companies and users, so special attention is necessary from the web page operator.

You can also additionally using the ‘html_meta_title‘ filter, you can find login pages with expired SSL certificates.

Search Keyword: “html_meta_title: login, ssl_expired: true”

Search for "html_meta_title: login, ssl_expired: true" to find a login page with expired SSL certificates, more than 200 cases are searched

Search for “html_meta_title: login, ssl_expired: true” to find a login page with expired SSL certificates, more than 200 cases are searched

 

Login page with an expired SSL certificate. It's marked "Not secure" at the address bar

Login page with an expired SSL certificate. It’s marked “Not secure” at the address bar

 

Source : Criminal IP (https://www.criminalip.io)