4 ms·

FYI: Your site has been unreachable since April if you use Symantec certificates. Chrome announced the depreciation for October but they didn't stick to their

FYI: Your site has been unreachable since April if you use Symantec certificates. Chrome announced the depreciation for October but they didn't stick to their own roadmap and blacklisted Symantec since April instead (Chrome 66 release). https://security.googleblog.com/2018/03/distrust-of-symantec-pki-immediate.html https://security.googleblog.com/2018/03/distrust-of-symantec...

phobosdeimos 8y ago
Yeah I have seen ecommerce sites that were using Symantec. Nobody cares about Firefox I guess but once Chrome starts enforcement shit will hit the fan.
- user5994461 8y ago
  Point being. Chrome already started enforcement in April.
paulddraper 8y ago
Not sure why this is downvoted. It is correct.
- Ajedi32 8y ago
  Because it's wrong. The very post GP linked explicitly says that Symantec certs issued before June 1, 2016 would stop functioning in Chrome 66.
  - user5994461 8y ago
    Chrome also blacklisted certs issued after June 1, 2016.
    - oasisbob 8y ago
      I understand if you don't want to reveal your organization affiliations, but if this was widespread, it should have been discussed somewhere with more specifics. Can you link to a discussion anywhere with more specific examples? We had a bunch of RapidSSL certs in-use internally, and were rather pokey in replacing them since they were less-critical internal certs. Everything with the deprecation warnings were exactly as expected and announced. I follow Mozilla's dev Security list and the CAB Forum mailing lists fairly regularly, can't find any discussions about Google deviating from their announced plan.
    - plttn 8y ago
      You can imagine how ridiculous this sounds right? If Google had blacklisted these certs in April as you claim, would that have not been a massive shitshow for everyone involved, and would have been on the top of HN?
klodolph 8y ago
Can you post the original roadmap that they didn’t follow? I can’t find a roadmap that doesn’t list April 2018 / Chrome 66 as the time when Symantec certificates issued prior to June 2016 will become distrusted. https://security.googleblog.com/2017/09/chromes-plan-to-distrust-symantec.html https://security.googleblog.com/2017/09/chromes-plan-to-dist...

phobosdeimos 8y ago

Yeah I have seen ecommerce sites that were using Symantec. Nobody cares about Firefox I guess but once Chrome starts enforcement shit will hit the fan.

user5994461 8y ago
Point being. Chrome already started enforcement in April.

paulddraper 8y ago

Not sure why this is downvoted. It is correct.

Ajedi32 8y ago
Because it's wrong. The very post GP linked explicitly says that Symantec certs issued before June 1, 2016 would stop functioning in Chrome 66.
- user5994461 8y ago
  Chrome also blacklisted certs issued after June 1, 2016.
  - oasisbob 8y ago
    I understand if you don't want to reveal your organization affiliations, but if this was widespread, it should have been discussed somewhere with more specifics. Can you link to a discussion anywhere with more specific examples? We had a bunch of RapidSSL certs in-use internally, and were rather pokey in replacing them since they were less-critical internal certs. Everything with the deprecation warnings were exactly as expected and announced. I follow Mozilla's dev Security list and the CAB Forum mailing lists fairly regularly, can't find any discussions about Google deviating from their announced plan.
  - plttn 8y ago
    You can imagine how ridiculous this sounds right? If Google had blacklisted these certs in April as you claim, would that have not been a massive shitshow for everyone involved, and would have been on the top of HN?

klodolph 8y ago

Can you post the original roadmap that they didn’t follow? I can’t find a roadmap that doesn’t list April 2018 / Chrome 66 as the time when Symantec certificates issued prior to June 2016 will become distrusted. https://security.googleblog.com/2017/09/chromes-plan-to-distrust-symantec.html https://security.googleblog.com/2017/09/chromes-plan-to-dist...