Verisign Unveils New "Verisign Informed" Security Service and Moves to Secure .pki Top-Level Domain

In a significant expansion of its security and infrastructure portfolio, Verisign (NASDAQ: VRSN) has officially announced the development of a new real-time security product dubbed Verisign Informed. The announcement, which coincides with the company’s formal application for the .pki top-level domain (TLD), marks a strategic push by the internet infrastructure giant to address long-standing vulnerabilities in the way digital trust is established and maintained across the global network.

The core objective of Verisign Informed is to combat what the company describes as "stale trust"—a pervasive security gap where systems make critical authentication and encryption decisions based on outdated or cached security certificate information. As cyber threats evolve and the speed of digital exploitation increases, the lag between the revocation of a compromised certificate and the recognition of that revocation by end-user systems has become a primary target for sophisticated actors.

Addressing the Vulnerability of Stale Trust

In the current architecture of the internet, Public Key Infrastructure (PKI) serves as the bedrock of security. Digital certificates are used to verify the identity of websites, encrypt communications, and sign software. However, this system relies heavily on the ability to effectively communicate when a certificate should no longer be trusted. If a private key is stolen or a certificate is otherwise compromised, it is revoked by the issuing authority.

The challenge lies in the dissemination of this revocation status. Traditionally, systems have relied on Certificate Revocation Lists (CRLs) or cached responses that may only update periodically. This latency creates a "window of vulnerability" where a revoked and potentially malicious certificate continues to be honored by browsers, servers, and automated systems. Verisign Informed is designed to act as a high-performance, real-time certificate status service that provides the most current information available regarding a certificate’s validity.

By offering a centralized, highly available source of truth, Verisign aims to ensure that when a system queries the status of a certificate, it receives an answer that reflects the immediate reality of that certificate’s standing. This move is particularly relevant in an era where automated attacks and artificial intelligence are being used to identify and exploit security gaps within minutes or even seconds of their appearance.

Technical Implementation and Scale

At its technical core, Verisign Informed utilizes the Online Certificate Status Protocol (OCSP). When a system needs to verify a certificate before establishing a trusted connection, it can query the Verisign Informed service. The service then returns a cryptographically signed OCSP response. This signature is vital, as it ensures the integrity of the status report itself, preventing attackers from intercepting the query and providing a false "valid" response for a revoked certificate.