Tapestry security certificate

[EmilyTapestrySupport]

We are approaching the point where our security certificate for Tapestry will be renewed. We wanted to let you know that this time, we are planning to stop using 'Enhanced Validation' on the certificate.

Enhanced Validation didn't change how secure your connection to Tapestry was, but in times gone by, it would show a green box in the address bar of the browser stating that the site was owned by 'The Foundation Stage Forum Ltd'. The idea was that, when you logged into Tapestry, you would do some research to establish that, yes, The Foundation Stage Forum Ltd is the company you wanted to communicate with and that, yes, the name had not been changed. 

In practice, almost no one did those checks and the people that did check could be fooled by a certificate registered to a company with a similar name. So it didn't add any extra security and, worse, could lull people into a false sense of security. 

For that reason, modern browsers are no longer showing the green box. Instead, they just warn if a site isn't secure.

While the enhanced validation approach to security has been retired, there have been other new approaches invented to keep certificates secure, such revocation lists, certificate authority authorisation, the online certificate status protocol and certificate transparency.

We have been adopting those new approaches as they become available and we think the time has come for us to retire the enhanced validation on our certificate.

By retiring the enhanced validation we will also, by a very small amount, be increasing the security of Tapestry because the process of managing the enhanced validation was complex and required the transfer of and storage of confidential information between us, the validation authority and our servers. Now we can keep all the confidential information in one spot, with much greater security, eliminating both a (albeit tiny) security risk and a (slightly larger) risk of a bureaucratic mistake rendering tapestry inaccessible. 

If you have questions or comments on this change, please do get in touch by emailing customer.service@eyfs.info.