4 ms·

As I understand it, Chrome and Firefox are both operating under the same policies with about the same timetables. Full distrust doesn't come until Firefox 63 /

As I understand it, Chrome and Firefox are both operating under the same policies with about the same timetables. Full distrust doesn't come until Firefox 63 / Chrome 70 - neither of which are stable releases yet. The limited distrust (for older certs issued prior to June 2016) was activated in Firefox 60 and Chrome 66 much earlier this year.

user5994461 8y ago
That's factually incorrect. Google blacklisted ALL Symantec certificates since Chrome 66, in April. The roadmap announced the change for October but they did it 6 months earlier, ignoring their own roadmap. As the OP says, organizations using Symantec have already been hit very hard, by surprise.
- oasisbob 8y ago
  Do you have a source for that? Google's KB articles still reference Chrome 70 [1], and I can't find another reference to this anywhere else. Paypal.com is still operating with a Symantec signed cert - issued by "Symantec Class 3 EV SSL CA - G3". Works fine in Chrome 68. (and not in Firefox with the security.pki.distrust_ca_policy override set) [1] https://support.google.com/chrome/a/answer/7662561?hl=en https://support.google.com/chrome/a/answer/7662561?hl=en
  - user5994461 8y ago
    I worked at a large company whose sole supplier was Symantec. Everything has been blacklisted since April.
    - brazzledazzle 8y ago
      Similar environment except for the blacklisting didn’t happen to us. Any chance some wires were crossed and someone pushed out a policy explicitly distrusting the CA?
    - SpikeDad 8y ago
      I think a source implies an authoritative source and not an anecdotal source.
    - zachberger 8y ago
      Yeah. Not true. I visit many sites with Symantec certs in Chrome 69 that don't work in Chrome 70
- Enverex 8y ago
  This isn't true. Chrome itself proves this when loading a site affected by wave 2 of the distrust: "The SSL certificate used to load resources from https://(domain) https://(domain) will be distrusted in M70. Once distrusted, users will be prevented from loading these resources. See https://g.co/chrome/symantecpkicerts https://g.co/chrome/symantecpkicerts for more information." Everything was being done in 2 waves. First wave was Chrome 66, second wave is Chrome 70. See Google's link above for the specifics. Source: Chrome's own warnings and that I work for a business that deals heavily in SSL sales.

user5994461 8y ago

That's factually incorrect. Google blacklisted ALL Symantec certificates since Chrome 66, in April. The roadmap announced the change for October but they did it 6 months earlier, ignoring their own roadmap. As the OP says, organizations using Symantec have already been hit very hard, by surprise.

oasisbob 8y ago
Do you have a source for that? Google's KB articles still reference Chrome 70 [1], and I can't find another reference to this anywhere else. Paypal.com is still operating with a Symantec signed cert - issued by "Symantec Class 3 EV SSL CA - G3". Works fine in Chrome 68. (and not in Firefox with the security.pki.distrust_ca_policy override set) [1] https://support.google.com/chrome/a/answer/7662561?hl=en https://support.google.com/chrome/a/answer/7662561?hl=en
- user5994461 8y ago
  I worked at a large company whose sole supplier was Symantec. Everything has been blacklisted since April.
  - brazzledazzle 8y ago
    Similar environment except for the blacklisting didn’t happen to us. Any chance some wires were crossed and someone pushed out a policy explicitly distrusting the CA?
  - SpikeDad 8y ago
    I think a source implies an authoritative source and not an anecdotal source.
  - zachberger 8y ago
    Yeah. Not true. I visit many sites with Symantec certs in Chrome 69 that don't work in Chrome 70
Enverex 8y ago
This isn't true. Chrome itself proves this when loading a site affected by wave 2 of the distrust: "The SSL certificate used to load resources from https://(domain) https://(domain) will be distrusted in M70. Once distrusted, users will be prevented from loading these resources. See https://g.co/chrome/symantecpkicerts https://g.co/chrome/symantecpkicerts for more information." Everything was being done in 2 waves. First wave was Chrome 66, second wave is Chrome 70. See Google's link above for the specifics. Source: Chrome's own warnings and that I work for a business that deals heavily in SSL sales.