Today, I am delighted to announce an exciting new feature in Bing Webmaster Tools pertaining to security. Track Certificates (Preview) — which was built in collaboration with Microsoft OSG Enterprise Security — allows you to track and review certificates that were requested by browsers visiting your site right from within Bing Webmaster Tools. What’s more, Track Certificate not only shows you the certificates we encountered, you can also directly report certificates to Microsoft if they look fraudulent or suspicious. All reported certificates will be reviewed and appropriate action will be taken by Microsoft, including involving the issuing Certificate Authority, or informing other browser manufacturers about the certificate.
Why “Preview”?
The Track Certificates tool is currently offered as a “Preview” and here’s why: under the hood, Track Certificates uses telemetry data that was captured by the Microsoft Certificate Reputation system and is from browsers running on the upcoming Microsoft operating system Windows 10. Since Windows 10 is currently available as a Preview to the Windows Insider Program, the data collected is not yet as comprehensive as it will be once Windows 10 becomes available more broadly to the general public. In addition, we still have some functionality to add (including items based on tool usage and your valuable feedback!). However, once we are showing data for your site, it will be accurate and if you report a certificate as suspicious to Microsoft using the Report link, your report will be reviewed and actionedon, so make sure to not report valid certificates as fraudulent or suspicious!
So what does Track Certificates Show me?
You can find Track Certificates in a new Webmaster Tools section called “Security” (which going forward also contains the Malware Re-Evaluation tool). Once we have captured information about certificates that were requested by browsers visiting your site, it will be shown in the Track Certificates table as shown in the following screen capture:
Tracked Data
Here is an overview of the fields in Track Certificates that are available and their meaning:
- Host: the fully name of the server where our telemetry captured the certificate.
- Issued to: the name of the entity to which the certificate was issued.
- Issued by: the name of the entity that issued the certificate.
- First seen: date and time of the occasion on which we collected information about this certificate in our telemetry.
- Last seen: date and time of the last occasion on which we collected information about this certificate in our telemetry.
- Expiry date: the date on which the certificate will lose its validity.
- Download: a link that lets you download the certificate for closer inspection. Currently this is a X.509 certificate in binary DER format. (PKCS#7 is planned for a future release).
- Report to Microsoft: a link that lets you report the certificate to Microsoft in case it is fraudulent.
Please also see the help article for Track Certificates for more details. Also, if you are entirely new to certificates and want to know more, the CA/Browser forum website has some great information.
Give us Your Feedback!
We strongly feel that webmasters and site owners are the most qualified entities in helping to determine whether certificates that appeared for their sites are fraudulent or not. With Track Certificates, we allow webmasters and site owners to review certificates that were requested by browsers when accessing their site and to report them to Microsoft should they be suspicious. This helps websites and their users stay safe and protect sensitive information on the Web as a whole.
Although data may not yet be available for all sites during Preview, if your site uses SSL certificates, I encourage you to give the Track Certificates feature a try. I also encourage you to provide feedback directly in Webmaster Tools using the Submit Feedback tool, hit me up on Twitter, or let me know your thoughts in the comments below.
Happy tracking & the very best from Seattle!
Vincent Wehren — Senior Product Lead – Bing Webmaster & Publisher Experiences – @vincentwehren