Encryption as a pillar of digitalisation

We had the opportunity to speak with Managing Director Patrycja Schrenk of PSW GROUP at CloudFest 2023 about the importance of encryption. We also discuss the history of website encryption and the future of the SSL market.

Hello Patrycja, could you briefly introduce to our readers what PSW does and what your main business is?

PSW GROUP is a German company specialising in IT security solutions and training. The company was founded in 2000 by Christian Heutger and is headquartered in Fulda. PSW GROUP’s services include, among other things, SSL certificates, email certificates, anti-spam and anti-virus solutions as well as cloud storage and backup services. PSW GROUP has a particular focus on the needs of small and medium-sized enterprises and offers solutions tailored to the specific needs and requirements of customers. In addition, training on IT security topics and consultancy are offered.

When you look at the market for SSL certificates over the last 10 years, what has changed for you?

We at PSW have noticed that the market for SSL certificates has grown steadily overall over the past 10 years. In particular since 2016, when Google announced that websites with SSL encryption would receive a ranking boost, we have seen strong growth. More and more websites and businesses are adopting HTTPS encryption to ensure the security of their users' data and to earn their customers' trust. At the same time, the technology around SSL certificates has evolved with new standards.

Since 2015 there has been the free alternative for SSL certificates, Let's Encrypt. How do you view it?

With the introduction of Let's Encrypt, SSL certificates are now offered free of charge. That is initially a positive development. However, there are also disadvantages when using Let's Encrypt certificates. The biggest disadvantage when using a Let's Encrypt certificate is compatibility with older browsers and systems. Let's Encrypt certificates are only offered at the lowest validation level, "domain validation", which can be more easily exploited for phishing. Furthermore, there is now a restriction on the number of Let's Encrypt certificates that can be issued. In addition, the question arises for me whether the service might at some point be further restricted and potentially offered as a paid premium service.

Can you tell us a little more about Certificate Authorities (CAs)?

A Certification Authority (CA) is an organisation that issues digital certificates that confirm the authenticity of identities, organisations, websites and devices on the Internet. The certificates contain information about the certificate holder, as well as the name of the CA that issued the certificate. The CA verifies the identity of the certificate holder and confirms the accuracy of the information contained in the certificate.

Why is Organisation Validation of the SSL certificate so important, for example, for online shops?

Organisation Validation (OV) is a category of SSL certificates that provides a higher level of identity validation than Domain Validation (DV). With OV, CAs must ensure that the identity of the certificate holder actually corresponds to the organisation that applied for the certificate. This is done by verifying company documents such as commercial register extracts and other legal documents.

OV is important for online shops because it gives customers a higher level of confidence in the authenticity of the shop and the protection of their sensitive data. The highest validation level is provided by Extended Validation (EV) certificates. These SSL certificates were previously used primarily by banks. Today EV certificates are increasingly seen on online shops and corporate websites. Because of the green address bar, it used to be easy for visitors to see the identity of the website owner. Unfortunately, this is no longer the case.

Digital signatures have been a trend for several years. Could you also present your solution for this?

The PSW GROUP offers digital signatures for a range of use cases.

Digital signatures allow documents such as invoices or contracts to be signed digitally, thereby replacing signatures on paper documents in private or business processes. The signatures are certified in accordance with the requirements of the eIDAS Regulation and meet the strict standards for identity validation. We have seen strong growth in this area in recent years, as it greatly simplifies order processing.

There are a multitude of CAs issuing different certificates — comparison can be difficult. What do you recommend to companies when selecting the right certificate?

I recommend that companies contact our support. Based on their individual requirements, our staff will help them choose the appropriate product.

Thank you very much for your time and have a great time in Rust!

The interview was conducted by Marco Keul, founder of hosttest, during CloudFest 2023 at Europa-Park in Rust.

Image: Patrycja Schrenk in the interview