Met Police in egg/face blunder as shop-a-crim site's SSL cert expires

The Metropolitan Police has allowed its SSL certificate to expire, possibly exposing users of its website to criminal snooping – and leaving victims and witnesses of crime vulnerable to exploitation.

With shocking disregard for the most basic standards of web security, the Met have allowed their SSL certificate for https://online.met.police.uk/ to expire.

An anonymous tip-off told The Register the certificate expired yesterday, leaving the public without a secure means of visiting the site over both days.

The SSL certificate is a cryptographically secure means of validating that (for instance) if you are trying to tell the police about a crime you have witnessed, you can be strongly confident that you are actually talking to the authorities, and not to a criminal in disguise.

Fail: Any technically-adept crim could read crime reports submitted through the Met's “secure” online portal

When SSL certificates expire, although the information passed between the browser and the server continues to be encrypted, users can no longer trust that the encryption has not been compromised.

Maintaining up-to-date certificates is pretty basic online security practice. That the Metropolitan police has woefully allowed its SSL certificate to expire suggests it's not taking its infosec obligations seriously.

SSL certificates are issued by a Certificate Authority (CA). In practice, anyone can be a CA; they merely need to be an entity trusted by both parties involved in the communication. The Electronic Frontiers Foundation previously reported that governments and CAs may be colluding to produce dodgy certs, allowing them to bypass users' encryption.

The Register contacted the Metropolitan Police for comment but none was forthcoming. ®