RefillRx.com and complementary sites are updating to SHA-2

Security is always a top priority and we are beginning our transition to a new standard of internet security, referred to as SHA-2.

This transition doesn't come without growing pains. Your internet browsers (Internet Explorer, Firefox, Chrome, Safari, etc) can store a saved version of the SSL certificate we utilized prior and upon return to the site, can cause your browser not to trust the site.

In order to remedy this problem, you must clear your SSL State. Most of the time a simple restart of your computer will clear it, other times you may need to manually clear it from your browser.

This problem will occur on other sites as they begin the transition to the more secure form of SSL, so it is also good information to know moving forward.

What happens on January 26th?

January 26th the security certificate for RefillRx.com will be transitioned to SHA-2. What this means for you is that RefillRx.com may become inaccessible if your SSL State has been cached by your browser.

If you are unable to view RefillRx.com after this date or if you are currently having problems accessing your pharmacies while logged in, please follow the instructions below.

PLEASE NOTE: Windows XP users on Service Pack 2 or lower cannot support the new SSL technology. You must update to Service Pack 3.

Chrome Users:
Go to Settings.
Click advanced settings at the bottom.
Scroll down to Network and click "Change Proxy Settings"
Go to the Content tab and then click "Clear SSL State"

Firefox Users:
Go to "History"
"Clear Recent History..."
Select "Active Logins"
Click "Clear Now"

Internet Explorer Users:
http://security.stackexchange.com/questions/40179/is-there-an-ssl-certificate-state-cache-on-windows-ie-and-outlook-and-how-it-i

Mac Users:
http://lists.gno.org/cert-maint-mac-10.5.8/

 

What Does Clear SSL State Mean?

The Secure Sockets Layer / Transport Level Security system that underpins secure connections on the Web does more than just scramble information. It also checks the identities of sites to which you securely connect to ensure that they are who you say they are. Those proofs of identities, called certificates, get stored in your computer's memory until you restart it or clear the SSL state.

SSL CERTIFICATES
When your Web browser initiates an SSL connection, it asks the server on the other end for a copy of its digital certificate. The certificate tells your Web browser how to encrypt data for that server and also who the other computer is. Your browser then verifies that computer's identify by checking its certificate with the company that issued it. Only once it finishes that process, called "SSL handshake," will it open a secure connection.

CACHING SSL CERTIFICATES
Setting up an SSL connection takes time. Your computer has to download the certificate and verify it, then use powerful public key encryption technology to establish how it will do encrypted transfers for the rest of the session. To save itself from having to go through this process every time it connects to that server, your computer stores, or caches, the certificates until you shut it down. That way, if it needs to reconnect, it's already part of the way there.

ISSUES WITH CACHING
Caching SSL certificates is a tradeoff, though. The data that you store on your computer could get corrupted, so that when you go back to reconnect to the site, you would have the wrong certificate information and the SSL handshaking process won't work. In addition, something could change with that other server's certificate, and you wouldn't know about it since you would still be working with a stored version.

CLEARING THE SSL STATE
Clearing the SSL state eliminates the problems of caching certificates since it wipes out the cache. Doing this shouldn't be necessary in day-to-day computing, since resetting your computer or, in some cases, closing your browser, will also clear your SSL state. However, this procedure can be useful if you don't reboot your computer very often or if you are encountering problems with SSL connections.

Reference: http://science.opposingviews.com/clear-ssl-state-mean-22093.html