4 ms·

Chrome doing likewise: https://security.googleblog.com/2018/03/distrust-of-symantec-pki-immediate.html https://security.googleblog.com/2018/03/distrust-of-syman

Chrome doing likewise: https://security.googleblog.com/2018/03/distrust-of-symantec-pki-immediate.html https://security.googleblog.com/2018/03/distrust-of-symantec...

kzrdude 8y ago
Chrome did this first, so any wide effect (in yall's organsiations) should already have been noticed by now, due to this.
- oasisbob 8y ago
  As I understand it, Chrome and Firefox are both operating under the same policies with about the same timetables. Full distrust doesn't come until Firefox 63 / Chrome 70 - neither of which are stable releases yet. The limited distrust (for older certs issued prior to June 2016) was activated in Firefox 60 and Chrome 66 much earlier this year.
  - user5994461 8y ago
    That's factually incorrect. Google blacklisted ALL Symantec certificates since Chrome 66, in April. The roadmap announced the change for October but they did it 6 months earlier, ignoring their own roadmap. As the OP says, organizations using Symantec have already been hit very hard, by surprise.
    - oasisbob 8y ago
      Do you have a source for that? Google's KB articles still reference Chrome 70 [1], and I can't find another reference to this anywhere else. Paypal.com is still operating with a Symantec signed cert - issued by "Symantec Class 3 EV SSL CA - G3". Works fine in Chrome 68. (and not in Firefox with the security.pki.distrust_ca_policy override set) [1] https://support.google.com/chrome/a/answer/7662561?hl=en https://support.google.com/chrome/a/answer/7662561?hl=en
      - user5994461 8y ago
        I worked at a large company whose sole supplier was Symantec. Everything has been blacklisted since April.
        brazzledazzle 8y ago
        Similar environment except for the blacklisting didn’t happen to us. Any chance some wires were crossed and someone pushed out a policy explicitly distrusting the CA?
        SpikeDad 8y ago
        I think a source implies an authoritative source and not an anecdotal source.
        zachberger 8y ago
        Yeah. Not true. I visit many sites with Symantec certs in Chrome 69 that don't work in Chrome 70
    - Enverex 8y ago
      This isn't true. Chrome itself proves this when loading a site affected by wave 2 of the distrust: "The SSL certificate used to load resources from https://(domain) https://(domain) will be distrusted in M70. Once distrusted, users will be prevented from loading these resources. See https://g.co/chrome/symantecpkicerts https://g.co/chrome/symantecpkicerts for more information." Everything was being done in 2 waves. First wave was Chrome 66, second wave is Chrome 70. See Google's link above for the specifics. Source: Chrome's own warnings and that I work for a business that deals heavily in SSL sales.
Jaepa 8y ago
Apple¹ and Mircosoft² are doing the same. Additionally anything that uses Chromium's trustlists (Vivaldi, Electron, etc) will also distrust old Symantec & co's certs. 1: https://support.apple.com/en-us/HT208860 https://support.apple.com/en-us/HT208860 2: https://knowledge.digicert.com/alerts/ALERT2562.html https://knowledge.digicert.com/alerts/ALERT2562.html EDIT: Its also worth mentioning that this isn't just limited Symantec certs but also will include GeoTrust, thawte, & VeriSign certs. Symantec's cert business has now been taken over by DigiCert so there is a means for valid reassurance. EDIT2: Also it will effect RapidSSL. Totally forgot about them.

Chrome doing likewise: https://security.googleblog.com/2018/03/distrust-of-symantec-pki-immediate.html https://security.googleblog.com/2018/03/distrust-of-symantec...

kzrdude 8y ago

Chrome did this first, so any wide effect (in yall's organsiations) should already have been noticed by now, due to this.

oasisbob 8y ago
As I understand it, Chrome and Firefox are both operating under the same policies with about the same timetables. Full distrust doesn't come until Firefox 63 / Chrome 70 - neither of which are stable releases yet. The limited distrust (for older certs issued prior to June 2016) was activated in Firefox 60 and Chrome 66 much earlier this year.
- user5994461 8y ago
  That's factually incorrect. Google blacklisted ALL Symantec certificates since Chrome 66, in April. The roadmap announced the change for October but they did it 6 months earlier, ignoring their own roadmap. As the OP says, organizations using Symantec have already been hit very hard, by surprise.
  - oasisbob 8y ago
    Do you have a source for that? Google's KB articles still reference Chrome 70 [1], and I can't find another reference to this anywhere else. Paypal.com is still operating with a Symantec signed cert - issued by "Symantec Class 3 EV SSL CA - G3". Works fine in Chrome 68. (and not in Firefox with the security.pki.distrust_ca_policy override set) [1] https://support.google.com/chrome/a/answer/7662561?hl=en https://support.google.com/chrome/a/answer/7662561?hl=en
    - user5994461 8y ago
      I worked at a large company whose sole supplier was Symantec. Everything has been blacklisted since April.
      - brazzledazzle 8y ago
        Similar environment except for the blacklisting didn’t happen to us. Any chance some wires were crossed and someone pushed out a policy explicitly distrusting the CA?
      - SpikeDad 8y ago
        I think a source implies an authoritative source and not an anecdotal source.
      - zachberger 8y ago
        Yeah. Not true. I visit many sites with Symantec certs in Chrome 69 that don't work in Chrome 70
  - Enverex 8y ago
    This isn't true. Chrome itself proves this when loading a site affected by wave 2 of the distrust: "The SSL certificate used to load resources from https://(domain) https://(domain) will be distrusted in M70. Once distrusted, users will be prevented from loading these resources. See https://g.co/chrome/symantecpkicerts https://g.co/chrome/symantecpkicerts for more information." Everything was being done in 2 waves. First wave was Chrome 66, second wave is Chrome 70. See Google's link above for the specifics. Source: Chrome's own warnings and that I work for a business that deals heavily in SSL sales.

Jaepa 8y ago

Apple¹ and Mircosoft² are doing the same. Additionally anything that uses Chromium's trustlists (Vivaldi, Electron, etc) will also distrust old Symantec & co's certs. 1: https://support.apple.com/en-us/HT208860 https://support.apple.com/en-us/HT208860 2: https://knowledge.digicert.com/alerts/ALERT2562.html https://knowledge.digicert.com/alerts/ALERT2562.html EDIT: Its also worth mentioning that this isn't just limited Symantec certs but also will include GeoTrust, thawte, & VeriSign certs. Symantec's cert business has now been taken over by DigiCert so there is a means for valid reassurance. EDIT2: Also it will effect RapidSSL. Totally forgot about them.