5 ms·

Chrome canary (66) blocks symantec issued SSL certificates

58 points by vvoyer 9y ago

wcoenen 9y ago
Background: https://security.googleblog.com/2015/10/sustaining-digital-certificate-security.html https://security.googleblog.com/2015/10/sustaining-digital-c...
- arkadiyt 9y ago
  That is a previous Symantec incident from 2015. It certainly adds to the history of issues they've had, but Google announced their plans to distrust Symantec in this more recent blog post, in response to a series of misissued certificates that came to light in January 2017: https://security.googleblog.com/2017/09/chromes-plan-to-distrust-symantec.html https://security.googleblog.com/2017/09/chromes-plan-to-dist... After Google published that post, Symantec responded with their own open letter objecting to Google here: https://www.symantec.com/connect/blogs/symantec-backs-its-ca https://www.symantec.com/connect/blogs/symantec-backs-its-ca However they subsequently relented, and decided to sell their PKI business to Digicert rather than rebuild it as would be necessary to regain browser trust.
PuffinBlue 9y ago
Anyone out there with Chrome Canary verify the claims? I run Linux and unfortunately Google hasn't seen fit to grace us with access to Canary on this platform.
- petetnt 9y ago
  Warnings have been thrown on recent Chrome versions to console about this for a while now
  - f2n 9y ago
    Where? I went to https://www.symantec.com/ https://www.symantec.com/ in Chrome Stable 63.0.3239.140 and didn't see any entries in the dev console about the CA being untrusted or anything like that. EDIT: I'm an idiot, it didn't occur to me that Symantec didn't sign their own cert. But they don't, it's from DigiCert. Can anyone link to a site that uses Symantec certs?
    - crtqt3 9y ago
      https://www.foxnews.com/ https://www.foxnews.com/
    - timmaah 9y ago
      https://static.ctctcdn.com/ https://static.ctctcdn.com/ Console throws up this warning about M70 though. > The SSL certificate used to load resources from https://static.ctctcdn.com https://static.ctctcdn.com will be distrusted in M70. Once distrusted, users will be prevented from loading these resources. See https://g.co/chrome/symantecpkicerts https://g.co/chrome/symantecpkicerts for more information.
    - galori 9y ago
      FYI This other comment: https://news.ycombinator.com/item?id=16300104 https://news.ycombinator.com/item?id=16300104 Says Symantec sold their cert business to DigiCert So could it be a cert that was issued as Symantec and just now shows as DigiCert and would still give you the error?
- almostApatriot1 9y ago
  you can open up your regular Chrome dev tools and look at the console for the warning. Any site with the warning raises the error in 66.
- mdaniel 9y ago
  Are you aware of the trunk builds of Chromium? https://download-chromium.appspot.com/?platform=Linux_x64&type=snapshots https://download-chromium.appspot.com/?platform=Linux_x64&ty... I deeply appreciate that's not "Chrome," nor Canary, but wanted to offer it in case you weren't previously aware
  - PuffinBlue 9y ago
    I wasn't, thanks!
teknopaul 9y ago
Peronally I lost faith in browser makers ability to determine trust along time ago. Validate on first use and peer verified checksums of certs is a much better idea imho. Works for ssh. Where security matters, bank, logins, etc one click to validate an md5 sum against a hash on the webpage itself would be better than Google tring to police who has had their web server hacked.
- diroussel 9y ago
  If you visit a few different ssh hosts in a week, and just a few new hosts each month, then trusting the host cert manually is feasible (but who actually verifies). But it's easy in a short browsing session for your User Agent to connect to hundreds of machines over TLS. Manually verifying them all is not feasible. And verify against what? A webpage? How is that validated. TLS and X.509 certs have their flaws, but ssh style trust is not the solution. The problem is: if your browser adds a CA to it's trust root, it can issue (and thus your browser trusts) any site on the internet. I would rather that if I visit https://www.police.uk https://www.police.uk then the certificate is issued by a CA that specifically allowed to issue .uk domain certs. Currently my system trusts "Belguim Root CA2" and "Amazon Root CA 1". Should they be able to sign certs for the .ca or .edu domains? Do I trust Amazon enough to not issue certs for their competitors?

58 points by vvoyer 9y ago

Background: https://security.googleblog.com/2015/10/sustaining-digital-certificate-security.html https://security.googleblog.com/2015/10/sustaining-digital-c...

arkadiyt 9y ago
That is a previous Symantec incident from 2015. It certainly adds to the history of issues they've had, but Google announced their plans to distrust Symantec in this more recent blog post, in response to a series of misissued certificates that came to light in January 2017: https://security.googleblog.com/2017/09/chromes-plan-to-distrust-symantec.html https://security.googleblog.com/2017/09/chromes-plan-to-dist... After Google published that post, Symantec responded with their own open letter objecting to Google here: https://www.symantec.com/connect/blogs/symantec-backs-its-ca https://www.symantec.com/connect/blogs/symantec-backs-its-ca However they subsequently relented, and decided to sell their PKI business to Digicert rather than rebuild it as would be necessary to regain browser trust.

PuffinBlue 9y ago

Anyone out there with Chrome Canary verify the claims? I run Linux and unfortunately Google hasn't seen fit to grace us with access to Canary on this platform.

petetnt 9y ago
Warnings have been thrown on recent Chrome versions to console about this for a while now
- f2n 9y ago
  Where? I went to https://www.symantec.com/ https://www.symantec.com/ in Chrome Stable 63.0.3239.140 and didn't see any entries in the dev console about the CA being untrusted or anything like that. EDIT: I'm an idiot, it didn't occur to me that Symantec didn't sign their own cert. But they don't, it's from DigiCert. Can anyone link to a site that uses Symantec certs?
  - crtqt3 9y ago
    https://www.foxnews.com/ https://www.foxnews.com/
  - timmaah 9y ago
    https://static.ctctcdn.com/ https://static.ctctcdn.com/ Console throws up this warning about M70 though. > The SSL certificate used to load resources from https://static.ctctcdn.com https://static.ctctcdn.com will be distrusted in M70. Once distrusted, users will be prevented from loading these resources. See https://g.co/chrome/symantecpkicerts https://g.co/chrome/symantecpkicerts for more information.
  - galori 9y ago
    FYI This other comment: https://news.ycombinator.com/item?id=16300104 https://news.ycombinator.com/item?id=16300104 Says Symantec sold their cert business to DigiCert So could it be a cert that was issued as Symantec and just now shows as DigiCert and would still give you the error?
almostApatriot1 9y ago
you can open up your regular Chrome dev tools and look at the console for the warning. Any site with the warning raises the error in 66.
mdaniel 9y ago
Are you aware of the trunk builds of Chromium? https://download-chromium.appspot.com/?platform=Linux_x64&type=snapshots https://download-chromium.appspot.com/?platform=Linux_x64&ty... I deeply appreciate that's not "Chrome," nor Canary, but wanted to offer it in case you weren't previously aware
- PuffinBlue 9y ago
  I wasn't, thanks!

teknopaul 9y ago

Peronally I lost faith in browser makers ability to determine trust along time ago. Validate on first use and peer verified checksums of certs is a much better idea imho. Works for ssh. Where security matters, bank, logins, etc one click to validate an md5 sum against a hash on the webpage itself would be better than Google tring to police who has had their web server hacked.

diroussel 9y ago
If you visit a few different ssh hosts in a week, and just a few new hosts each month, then trusting the host cert manually is feasible (but who actually verifies). But it's easy in a short browsing session for your User Agent to connect to hundreds of machines over TLS. Manually verifying them all is not feasible. And verify against what? A webpage? How is that validated. TLS and X.509 certs have their flaws, but ssh style trust is not the solution. The problem is: if your browser adds a CA to it's trust root, it can issue (and thus your browser trusts) any site on the internet. I would rather that if I visit https://www.police.uk https://www.police.uk then the certificate is issued by a CA that specifically allowed to issue .uk domain certs. Currently my system trusts "Belguim Root CA2" and "Amazon Root CA 1". Should they be able to sign certs for the .ca or .edu domains? Do I trust Amazon enough to not issue certs for their competitors?