Google: timeline for distrusting all Symantec Certificates in Chrome

Google published a timeline recently on the Google Security blog which highlights the timeline for dropping support for Symantec-issued certificates in Chrome.

The company plans to drop full support in Chrome 70, but will distrust certificates that were issued before June 1, 2016 as early as March 15, 2018 (Chrome 66).

The core of the issue surrounding Symantec certificates — the business operates under brand names such as VeriSign, Thawte, Equifac, RapidSSL or GeoTrust — is that Symantec “entrusted several organizations with the ability to issue certificates without the appropriate or necessary oversight” according to Google.

symantec certificate google chrome firefox

Symantec was aware of these security deficiencies, and incidents in the past showed just how bad it was. In 2015 for instance, certificates were created covering five organizations including Google and Opera without the knowledge of the organizations involved.

Symantec came to an agreement with DigiCert under which DigiCert will acquire Symantec’s website security and PKI solutions business.

Google plans to remove trust from all Symantec-issued certificates in Chrome in the coming year. The company published a timeline that highlights the most important dates of the process.

  • October 24, 2017 — Chrome 62 Stable — Chrome highlights if a certificate of a site will be distrusted when Chrome 66 gets released.
  • December 1, 2017 — DigiCert’s new infrastructure will be “capable of full issuance”. Certificates issued by Symantec’s old infrastructure from this point forward will cease working in future updates. This won’t affect certificates issued by DigiCert.
  • March 15, 2018 — Chrome 66 Beta — Any Symantec issued certificate before June 1, 2016 is distrusted. Sites won’t load but throw a certificate alert instead.
  • September 13, 2018 — Chrome 70 Beta — Trust in Symantec’s old infrastructure is dropped entirely in Google Chrome. This won’t affect DigiCert issued certificates, but will block any site that uses old certificates.

Chrome users cannot really do anything about this, as website operators need to switch to a certificate that is still trusted by Google as early as March 14, 2018. The only option that users of the browser have is to let website operators know about certificate issues should they not be aware of this.

Mozilla will match the dates proposed by Google earlier according to a post by Gervase Markham on the Mozilla Dev Security Policy group.

Webmasters who run sites with Symantec certificates need to add new certificates to their web properties before the deadline to ensure continued access to those properties. One option that webmasters have is to use Lets Encrypt which offers free and automated certificates.

Summary

Article Name

Google: timeline for distrusting all Symantec Certificates in Chrome

Description

Google published a timeline recently on the Google Security blog which highlights the timeline for dropping support for Symantec-issued certificates in Chrome.

Author

Martin Brinkmann

Publisher

Ghacks Technology News

Logo

About Martin Brinkmann

Martin Brinkmann is a journalist from Germany who founded Ghacks Technology News Back in 2005. He is passionate about all things tech and knows the Internet and computers like the back of his hand.You can follow Martin on Facebook, Twitter or Google+

Symantec Responds To Google Distrusting Its Certificates

Google announced in March that its Chrome browser would gradually stop trusting certificates issued by Symantec because the company improperly issued 30,000 certificates over the last few years. Symantec responded today with a blog post saying it’s met with Google to discuss the issue several times and that its customers have said the change would “cause significant business disruption and additional expense.”

Certificates are used to verify a website operator’s identity. If everything’s on the up-and-up, browsers can then form secure connections with the site, which allows you to send or access sensitive data without having to worry about it being compromised. This means it’s important for certificates to be properly issued; otherwise an ostensibly secure connection might actually put your private information at risk.

Google discovered in 2015 that Symantec issued certificates for its Google.com domain even though it never requested those certificates. This led both companies to investigate Symantec’s certificate issuing process, and eventually they discovered several mis-issued certificates. Google said roughly 30,000 certificates were improperly issued; Symantec said in a message to its customers that only 127 certificates weren’t properly issued.

Symantec also said that the mis-issued certificates “resulted in no consumer harm” and that it believed Google’s statements were “exaggerated and misleading.” The company added that it would “vigorously defend the safe and productive use of the internet, including minimizing any potential disruption caused by the proposal in Google’s blog post,” and that it was “open to discussing the matter with Google” in the future.

Now the company has issued another message to its customers about Chrome not trusting its certificates. Symantec said it’s met with Google several times to work towards a solution that won’t result in problems for its customers or consumers. Here’s the crux of the post:

We have also heard consistently from customers like you that the transition to fully adopt Google’s proposal within its suggested timeframe would cause significant business disruption and additional expense – especially within complex IT infrastructures. Mitigating these concerns is a top priority for us as we develop our counter proposal and provide responses to the salient questions the community has posted online. While we believe Google understands the burden their proposal creates, if they decide to move ahead with their original plan, I want to reassure you that Symantec will keep your websites, web servers or web applications operational across all browsers. Specifically, this may require Symantec to reissue your certificates, which we would do as needed, at no charge to you, to meet the fully expected validity period.

This isn’t an easy problem to solve. Google acknowledged in March that Chrome distrusting Symantec-issued certificates would likely result in consumers blaming the browser for their problems, and as Symantec made clear today, its customers would have to scramble to meet Google’s requirements. A failure on either company’s part could endanger consumer privacy or make it hard for website operators to serve their customers.

Symantec asked its customers to fill out an anonymous survey about the issue. It has just four questions:

  • How important are Symantec’s Extended Validation certificates to you
  • What are the barriers to adopting shorter validity certificates
  • On what timeframe could you successfully adopt shorter validity certificates
  • What impact would Google’s proposal have on your business?

That seems (unsurprisingly) one-sided.

Affected businesses have a while to respond. Chrome will slowly require shorter validity certificates over time–Chrome 59 will trust certificates for 33 months, for example, whereas Chrome 64 will trust them for only nine months. Chrome 64 isn’t expected to reach the average consumer until early 2018, however, which leaves businesses almost a year to implement the shorter validity certificates to avoid downtime for their websites.