SSL Google Chrome 56+ distrusting WoSign, StartSSL/StartCom SSL certificates !

eva2000 · Nov 1, 2016

wow Google has fired a few more nails into the coffin for WoSign/StartSSL - Google Online Security Blog: Distrusting WoSign and StartCom Certificates Previous discussions leading up to this can be found here.

Certificate Authorities (CAs) play a key role in web security by issuing digital certificates to website operators. These certificates are trusted by browsers to authenticate secure connections to websites. CAs who issue certificates outside the policies required by browsers and industry bodies can put the security and privacy of every web user at risk.

Google has determined that two CAs, WoSign and StartCom, have not maintained the high standards expected of CAs and will no longer be trusted by Google Chrome, in accordance with our Root Certificate Policy. This view is similar to the recent announcements by the root certificate programs of both Apple and Mozilla. The rest of this post provides background to that decision and how we plan to minimize disruption while still protecting users.
Click to expand...

Action

Beginning with Chrome 56, certificates issued by WoSign and StartCom after October 21, 2016 00:00:00 UTC will not be trusted. Certificates issued before this date may continue to be trusted, for a time, if they comply with the Certificate Transparency in Chrome policy or are issued to a limited set of domains known to be customers of WoSign and StartCom.

Due to a number of technical limitations and concerns, Google Chrome is unable to trust all pre-existing certificates while ensuring our users are sufficiently protected from further misissuance. As a result of these changes, customers of WoSign and StartCom may find their certificates no longer work in Chrome 56.

In subsequent Chrome releases, these exceptions will be reduced and ultimately removed, culminating in the full distrust of these CAs. This staged approach is solely to ensure sites have the opportunity to transition to other Certificate Authorities that are still trusted in Google Chrome, thus minimizing disruption to users of these sites. Sites that find themselves on this whitelist will be able to request early removal once they’ve transitioned to new certificates. Any attempt by WoSign or StartCom to circumvent these controls will result in immediate and complete removal of trust.

We remain committed to ensuring the safety and privacy of Google Chrome users. We appreciate the impact to users visiting sites with affected certificates and to the operators who run these sites, but the nature of these incidents, and the need to protect our users, prevent us from being able to take less disruptive steps.
Click to expand...

eva2000 · Nov 1, 2016

In previous thread at SSL - wosign ssl cert trainwreck, Mozilla was taken measures to distrust WoSign/StartCom but with a chance of them being re-admitted if they took certain measures. But seems Google is just outright distrusting them altogether !

According to W3Counter, Chrome and Firefox hold 57.1% and 10.4% market share respectively !

Let's Encrypt SSL certificates seem to be the one to get for free. Reminder Centmin Mod 123.09beta01 has addons/acmetool.sh for letsencrypt free ssl certificate integration that requires more testing and feedback at https://centminmod.com/acmetool

rdan · Nov 1, 2016

Ow I'm still using it one my mail server :/

R0rke · Nov 1, 2016

me too ? should we switch to let's encrypt ?

eva2000 · Nov 2, 2016

@RoldanLT and @R0rke I'd be switching to an alternative

R0rke · Nov 2, 2016

eva2000 said: ↑

@RoldanLT and @R0rke I'd be switching to an alternative
Click to expand...

well what alternative exactly ?
so simply you mean the let's encrypt already has that problem ?
we can't use acme tool?

eva2000 · Nov 2, 2016

R0rke said: ↑

we can't use acme tool?
Click to expand...

https://centminmod.com/acmetool is still in beta so you're welcome to try it on test server first and see if it suits your needs. Or just get a paid ssl certificate

I am testing Centmin Mod addons/acmetool.sh addon for my https://mysqlmymon.com/ site on test server

eva2000 · Feb 3, 2017

It's happening in Chrome 57 StartSSL Certificates not trusted in Chrome 57 - Web hosting - Whirlpool Forums
Just a heads up that Chrome 57 was released into Beta today and will no longer trust any StartSSL/Wosign issued certificates unless the site is in the Alexa Top 1M sites list.

Previous communication from Google (Google Online Security Blog: Distrusting WoSign and StartCom Certificates) had read as though it would only be certificates issued since October 21, 2016 wouldn't be trusted. It then went onto say that it may not trust other certificates but didn't really say what that meant.

The following commit in Chrome 57 now seems to give that detail:
Code:
commit    e719fc626a3b9a528bf226b704785bcb24d07868    
author    Ryan Sleevi <rsleevi@chromium.org>    Fri Jan 27 21:14:49 2017
committer    Ryan Sleevi <rsleevi@chromium.org>    Fri Jan 27 21:14:49 2017
Restrict the set of WoSign/StartCom certs to the Alexa Top 1M
Restrict the set of domains for which WoSign/StartCom certificates
are trusted to the set of domains intersecting the Alexa Top 1M
whose certificates are unexpired and unrevoked.
BUG=685826
I found one of my sites (that still had a valid cert issued in April 2015) suddenly showed as untrusted following an auto update of Chrome Beta this morning. Its now running with a LE cert and I think I have now purged StartSSL certs from my systems.
Click to expand...

Xon · Feb 3, 2017

Ah whingepool

SFLC · Feb 4, 2017

That's not cool if let's encrypt is affected, in my case im using cloudflare n I shouldn't see any issues unless I disable the cloudflare ssl as they use avast.

Not sure if outgoing mail will be affected, though. I don't have chrome 57, is there a beta, or how else are you guys testing this

eva2000 · Feb 4, 2017

Xon said: ↑

Ah whingepool
Click to expand...

heh Aussies fav forum

SFLC said: ↑

That's not cool if let's encrypt is affected, in my case im using cloudflare n I shouldn't see any issues unless I disable the cloudflare ssl as they use avast.

Not sure if outgoing mail will be affected, though. I don't have chrome 57, is there a beta, or how else are you guys testing this
Click to expand...

only affects startssl/startcom - see the rest of this thread as to why chrome is going to block and blacklist them. Won't affect letsencrypt

eva2000 · Mar 26, 2017

bye bye StartCOM/StartSSL StartSSL Certificates not trusted in Chrome 57 - Web hosting - Whirlpool Forums

Just a heads up that Chrome 57 was released into Beta today and will no longer trust any StartSSL/Wosign issued certificates unless the site is in the Alexa Top 1M sites list.

Previous communication from Google (Google Online Security Blog: Distrusting WoSign and StartCom Certificates) had read as though it would only be certificates issued since October 21, 2016 wouldn't be trusted. It then went onto say that it may not trust other certificates but didn't really say what that meant.

The following commit in Chrome 57 now seems to give that detail:

commit e719fc626a3b9a528bf226b704785bcb24d07868
author Ryan Sleevi <rsleevi@chromium.org> Fri Jan 27 21:14:49 2017
committer Ryan Sleevi <rsleevi@chromium.org> Fri Jan 27 21:14:49 2017
Restrict the set of WoSign/StartCom certs to the Alexa Top 1M
Restrict the set of domains for which WoSign/StartCom certificates
are trusted to the set of domains intersecting the Alexa Top 1M
whose certificates are unexpired and unrevoked.
BUG=685826
Click to expand...

Click to expand...

eva2000 · Apr 6, 2017

SSLLabs hammers another nail in their coffins https://community.centminmod.com/th...ign-and-startcom-startssl-certificates.11174/

eva2000 · Aug 12, 2017

And if you thought there weren't enough nails in StartSSL/WoSign's coffin, you guessed wrong Microsoft bins unloved Chinese cert shops

Microsoft's decided not to support digital certificates issued by Chinese outfits WoSign and StartCom, but the first-mentioned CA disputes the decision.

Google, Apple and Mozilla binned WoSign certs in 2016.

Microsoft says it has now “... concluded that the Chinese Certificate Authorities (CAs) WoSign and StartCom have failed to maintain the standards required by our Trusted Root Program.”

“Observed unacceptable security practices include back-dating SHA-1 certificates, mis-issuances of certificates, accidental certificate revocation, duplicate certificate serial numbers, and multiple CAB Forum Baseline Requirements (BR) violations.”

The decision means that “Windows 10 will not trust any new certificates from these CAs after September 2017” and allow “natural deprecation of WoSign and StartCom certificates by setting a “NotBefore” date of 26 September 2017.”
Click to expand...

Lesson here is don't piss off Google, Apple, Mozilla and Microsoft !

Log in / Register

Forums

Welcome to Centmin Mod Community

SSL Google Chrome 56+ distrusting WoSign, StartSSL/StartCom SSL certificates !

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

rdan Well-Known Member

R0rke Member

eva2000 Administrator Staff Member

R0rke Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

Xon Active Member

SFLC Active Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

.

Log in / Register

Useful Searches

Welcome to Centmin Mod Community

SSL Google Chrome 56+ distrusting WoSign, StartSSL/StartCom SSL certificates !

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

rdan Well-Known Member

R0rke Member

eva2000 Administrator Staff Member

R0rke Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

Xon Active Member

SFLC Active Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

.