0

I have come across the PCI DSS compliance which expects SSL certificates to comply with certain standards. I have come across this link which highlights :

  1. The latest PCI DSS 3.2 requires migration from early SSL/TLS version 1.0 to a secure version v1.1 or higher.

  2. Strong Private Key For RSA: 2048-bit+, For EC: 256-bit+

  3. Check the validity of the certificate (expiry)

Is there anything else to do to satisfy the PCI compliance regarding SSL or am I missing out anything?

  • 2
    Could you include the link you found please – jrtapsell Jan 4 '18 at 14:02
  • 1
    The PCI documentation will tell you what it expects. – schroeder Jan 4 '18 at 16:21
2

There's a lot to the PCI Standards that you'll have to get by reading the most recent standards. Read these standards in conjunction with the glossary, where it will explain things like what they consider "strong cryptography." For instance, PCI defines strong cryptography as:

AES (128 bits and higher), TDES/TDEA (triple-length keys), RSA (2048 bits and higher), ECC (224 bits and higher), and DSA/D-H (2048/224 bits and higher).

To clarify something from #1 in your question, PCI is requiring migration from SSL (any version) and early TLS (version 1.0). The terminology PCI uses is "SSL/early TLS." More about the migration can be found in PCI's information supplement, Migrating from SSL and Early TLS, or in Appendix A2 of the current standards linked above.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.