<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link="#0563C1" vlink="#954F72"><div class=WordSection1><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:9.0pt;font-family:"Arial",sans-serif;color:black'>On November 24, 2016 (Thanksgiving Day), an emergency situation arose whereby mobile application users of Barclays Bank would no longer be able to conduct transactions due to the pinning of an obsolete intermediate certificate in the application. The bank, through its application provider Axsy, urgently contacted Symantec to request a new certificate for *.<a href="http://payliquid.com/">payliquid.com</a> chained to the older intermediate CA. Symantec determined while this was possible, it could only be accomplished by issuing a certificate with a sequential serial number, in violation of CA/B Forum Baseline Requirements Section 7.1. This certificate issuance was issued from a legacy system that has since been replaced in part because it only supported certificate issuance using sequential serial numbers.<o:p></o:p></span></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:9.0pt;font-family:"Arial",sans-serif;color:black'>---------------------------</span><span style='font-size:12.0pt;font-family:"Times New Roman",serif;color:black'><o:p></o:p></span></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><u><span style='font-size:9.0pt;font-family:"Arial",sans-serif;color:black'>Background and options explored (from Barclays)</span></u><span style='font-size:9.0pt;font-family:"Arial",sans-serif;color:black'>:</span><u><span style='color:black'><o:p></o:p></span></u></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:9.0pt;font-family:"Arial",sans-serif;color:black'>“The recent change to the intermediate certificate negatively impacted Barclay’s SSL pinning solution. As a result, connection to our mobile application will fail for all users imminently. The only other option to fix this issue is underway and requires us to modify our existing iOS and Android mobile application code. This will take several weeks, including security testing, app store submission, approval and rollout. </span><span style='color:black'><o:p></o:p></span></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><u><span style='font-size:9.0pt;font-family:"Arial",sans-serif;color:black'>Merchant and consumer impact</span></u><span style='font-size:9.0pt;font-family:"Arial",sans-serif;color:black'>:</span><u><span style='color:black'><o:p></o:p></span></u></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:9.0pt;font-family:"Arial",sans-serif;color:black'>Without this exception, the impact on Barclays would be severe and fall mainly on its small and medium enterprise customers who utilise its payment acceptance devices that link to the application that is referred to above. </span><span style='color:black'><o:p></o:p></span></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:9.0pt;font-family:"Arial",sans-serif;color:black'>Several thousand SME customers mainly operating in the UK market would not be able to transact in a key trading period from 8.30am 25/11/16 on ‘Black Friday’ and into the festive trading period they rely on for their businesses to survive. It would impact hundreds of thousands of consumer payment transactions, until the application is updated and then released. It would also result in major reputational damage to Barclays and its business customers impacted.”<o:p></o:p></span></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:9.0pt;font-family:"Arial",sans-serif;color:black'>-----------------------------<o:p></o:p></span></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:9.0pt;font-family:"Arial",sans-serif;color:black'>Due to the criticality of this issue and the major impact to consumers and businesses on a significant holiday shopping period , Symantec issued the replacement certificate on the evening of November 24th. This certificate has a relatively short validity period and had been published in CT logs as shown here: <a href="https://crt.sh/?sha256=ADF3CF69897EF0F02549D27266D324D61AB5746AB6FAB0D89C122616B68B7441">https://crt.sh/?sha256=ADF3CF69897EF0F02549D27266D324D61AB5746AB6FAB0D89C122616B68B7441</a><o:p></o:p></span></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:9.0pt;font-family:"Arial",sans-serif;color:black'><o:p> </o:p></span></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:9.0pt;font-family:"Arial",sans-serif;color:black'>Dean Coclin<br>Symantec<o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>