4 ms·
"including Thawte, VeriSign, Equifax, GeoTrust, and RapidSSL" RIP RapidSSL wildcard
by dsp1234 9y ago
"including Thawte, VeriSign, Equifax, GeoTrust, and RapidSSL"
RIP RapidSSL wildcard
- _asummers 9y agoLE Wildcards should be around by then! Hopefully enough tooling will exist to make that migration seamless, or as seamless as cert migration can be.
- tomschlick 9y agoLE wildcards are coming early 2018 I believe so you'll still have a month or two gap.
- Guvante 9y agoNo action will be taken to impact users until March 15, 2018 at the earliest and only if you got your certificate before June 1, 2016. At least when it comes to any existing certificate (they are ambiguous about when they will cut off new certificates exactly).
- Ajedi32 9y ago> they are ambiguous about when they will cut off new certificates exactly They are? It seems pretty clear to me. Symantec's old infrastructure will be distrusted in Chrome beta in September 2018. At that point, no certificates issued by Symantec's old root certs (including those issued after June 1, 2016) will be trusted.
- Guvante 9y agoThey mentioned to not get any certificates from the old infrastructure after the new infrastructure is available as they will be untrusted earlier (to ensure that Symantec starts using the new infrastructure exclusively once it is available). However they didn't say when they would do that.
- gerdesj 9y agoYou'll be looking forwards to discovering how to do DNS dynamic updates. LE wildcard certs will only be DNS validated and not using a web server (for obvious reasons, when you think about it)
- timdorr 9y agoDigiCert is taking over the cert issuing infrastructure on Dec. 1st, so presumably those brands are coming along for the ride.
- JoeMalt 9y agoWow, I never realised VeriSign was a Symantec brand. I'm not sure what it says that Google doesn't trust the company that operates the registry for .com
- cbhl 9y agoOperating a domain registry and issuing EV certificates require different levels of trust. Don't read too much into Alphabet/Google using other gTLDs instead of .com, like https://abc.xyz https://abc.xyz or https://blog.google https://blog.google -- that's separate work done by separate people on a separate team.
- CydeWeys 9y agoWe are in contact, though. Don't read too little into it either ;)
- kuschku 9y agoFrom my own experience with TLDs, .com, .info, etc are the worst to deal with. It’s insane how wrong they get the TRANSFER process, and everything. On the other hand, I’m positively surprised by how well DENIC (.de) handles it all.
- bckygldstn 9y agoVerisign's SLL authentication business was spun off and sold to Symantec a while ago, but Verisign continues to operate the .com registry as a separate company.
- EthanV2 9y agoJust so I'm understanding the implications of this correctly, my company uses certs issued by Thawte. Would these certs be affected by this move?
- fauigerzigerk 9y agoSeems so. The article says: If you are a site operator with a certificate issued by a Symantec CA prior to June 1, 2016, then prior to the release of Chrome 66, you will need to replace the existing certificate with a new certificate from any Certificate Authority trusted by Chrome.
- theandrewbailey 9y agoAlso note that GeoTrust is Google's root CA.