SSL SSL Business... GAME ON!

Jimmy · Jul 14, 2017

World's No. 1 Certificate Authority Comodo Announces Upgrade Program for Symantec, Thawte and GeoTrust Certificates

Under the program, Comodo and its partners will provide an equivalent certificate that includes one year free for all existing Symantec, Thawte and GeoTrust certificates.

The offer targets owners of Symantec-issued digital certificates who want an upgrade. Recent news reports have discussed issues with respect to Symantec certificates and Google Chrome browser. When visitors to a site are using Google Chrome, the industry-leading browser, based on Google's proposals, Symantec-issued certificates will have a shorter life and not have the green trust padlock indicator. These proposals have the potential to cost businesses more for the shorter life cycle certificates, and potentially reduce traffic and revenue if consumer and partner use of the site declines.
Click to expand...

eva2000 · Jul 14, 2017

Companies that have previously purchased a Symantec certificate from a webhost or domain name registrar should contact their current provider, who may be able to offer a replacement Comodo certificate. Additionally, Comodo has created an online website certificate assessment tool to evaluate if a website is affected and explore options.
Click to expand...

Wow the vultrs didn't even wait till Symantec was dead to start picking at it's carcass ! Being a certificate authority is hard work to operate within the rules/guidelines ! Though it makes sense for folks to entertain such an offer if you have one of those affected Symantec SSL certificates.

from https://www.comodo.com/Google-Chrom...5sk1=a3c2e23f4f27c63f523f7ad497a094c00481234a

Google has stated its intent to take the following steps relating to the Chrome browser with respect to Symantec certificates:

Reduce the maximum accepted validity period of newly-issued Symantec certificates to 9 months or less

Implement a gradual distrust in Chrome browser of all current Symantec-issued certificates, requiring the certificates to be replaced with new certificates before the original would expire

Removal of recognition of the EV (Extended Validation) status of Symantec EV certificates for at least one year

Symantec's response to the proposal and a public discussion may be found here.
Click to expand...

Actually thinking about this more, I think companies using Symantec SSL certificates (EV SSL) would save heaps taking Comodo up on the offer as Symantec EV SSL certificates are way more costly ($570-900) than Comodo EV SSL certificates ($80-90). So if companies can get pro-rated refund for their Symantec EV SSL certificates 3/12 = 25% refunded + 1yr free + cheaper subsequent Comodo EV SSL certificate renewals = $$$$$ saved !

eva2000 · Jul 14, 2017

Google Groups

To balance the compatibility risks versus the security risks, we propose a gradual distrust of all existing Symantec-issued certificates, requiring that they be replaced over time with new, fully revalidated certificates, compliant with the current Baseline Requirements. This will be accomplished by gradually decreasing the ‘maximum age’ of Symantec-issued certificates over a series of releases, distrusting certificates whose validity period (the difference of notBefore to notAfter) exceeds the specified maximum.

The proposed schedule is as follows:

Chrome 59 (Dev, Beta, Stable): 33 months validity (1023 days)

Chrome 60 (Dev, Beta, Stable): 27 months validity (837 days)

Chrome 61 (Dev, Beta, Stable): 21 months validity (651 days)

Chrome 62 (Dev, Beta, Stable): 15 months validity (465 days)

Chrome 63 (Dev, Beta): 9 months validity (279 days)

Chrome 63 (Stable): 15 months validity (465 days)

Chrome 64 (Dev, Beta, Stable): 9 months validity (279 days)

The proposed schedule attempts to avoid making changes in Chrome 63 Stable, as that would be released during the winter holiday production freeze many organizations undergo. This is solely to reduce disruption for site operators and users, and attempts to resume with Chrome 64 following the holiday season. Further, the practical impact of the changes in Chrome 59 and 60 are relatively minimal, due to many of the certificates issued during that period of time being issued using SHA-1, which is no longer supported for certificates in Chrome.

In addition, we propose to require that all newly-issued certificates must have validity periods of no greater than 9 months (279 days) in order to be trusted in Google Chrome, effective Chrome 61. This ensures that the risk of any further misissuance is, at most, limited to nine months, and more importantly, that if any further action is warranted or necessary, that the entire ecosystem can migrate within that time period, thus minimizing the risk of further compatibility issues.

By combining these two steps, we can ensure that the level of assurance in Symantec-issued certificates is able to match what is expected by Google Chrome and the ecosystem, and that the risks posed both from past and possible future misissuance is minimized as much as possible.
Click to expand...

buik · Jul 14, 2017

eva2000 said: ↑

Actually thinking about this more, I think companies using Symantec SSL certificates (EV SSL) would save heaps taking Comodo up on the offer as Symantec EV SSL certificates are way more costly ($570-900) than Comodo EV SSL certificates ($80-90). So if companies can get pro-rated refund for their Symantec EV SSL certificates 3/12 = 25% refunded + 1yr free + cheaper subsequent Comodo EV SSL certificate renewals = $$$$$ saved !
Click to expand...

And there you are as a company with your multi million cost Symantec based, vendor locked information management system. (Not me, or my employer)

A few 100 $ discount is peanuts. Symantec is mostly to provide to the largest enterprises - trans national on this plant. Large company = large systems.

When hiring them or their Symantec solutions, the certs are included and anchored in their all-in system. Its not easy peasy like a 10k visitors month, website, change certs done, 5 min ready to go.

About Symantec certs fiasco. You can't approve it. You can not let it go without measures. But you can also exaggerate it. I know it has been discussed before but Google is hypocritical itself.

Check out the news about multi billion euro fines and see what they're all about.
Google has become too powerful and then you get business like this and like that.

About Comodo. Customers lure if the competitor commits an error or mistake.
Astonishing hypocrite. Knowing that in 2011, kind of the same happened at Comodo.

eva2000 · Jul 14, 2017

Indeed the world and internet works in interesting ways - especially when everyone does work 'for profit' whether it be financial or not.

It does make one argument about/for Letsencrypt's automated way of SSL certificate issuance. Acme v2 API Endpoint would be a IETF standard so other CA's could adopt and use ACME v2 API Endpoint Coming January 2018 - Let's Encrypt - Free SSL/TLS Certificates

buik · Jul 14, 2017

eva2000 said: ↑

Indeed the world and internet works in interesting ways - especially when everyone does work 'for profit' whether it be financial or not.

It does make one argument about/for Letsencrypt's automated way of SSL certificate issuance.
Click to expand...

No problem to make money, everyone needs a meal.
But it is hypocrite to play for Google as Messias If you attack someone (competitor as Google is cert provider itself) but violate the rules on another level. Or Comodo, begging for competitor Symantec's customers. Knowing that in 2011, the same happened at your own company.

And about Letsencrypt. According to Comodo. Letsencrypt is their trademark right. It's hilarious.

eva2000 · Jul 14, 2017

bassie said: ↑

And about Letsencrypt. According to Comodo. Letsencrypt is their trademark right. It's hilarious.
Click to expand...

IIRC, Comodo eventually dropped that claim ?

bassie said: ↑

(competitor as Google is cert provider itself) but violate the rules on another level.
Click to expand...

SSL/CA rules your mean ?

buik · Jul 14, 2017

eva2000 said: ↑

IIRC, Comodo eventually dropped that claim ?
Click to expand...

That's right, after enough negative media attention from both Lets-encrypt and the community, they eventually dropped charges.

eva2000 said: ↑

SSL/CA rules your mean ?
Click to expand...

Nup another level. About privacy, artificially and illegally promoting its own price comparison service etc etc. Google is evil. Wolf in sheep's clothing. It is true

Log in / Register

Forums

Join the community today

SSL SSL Business... GAME ON!

Jimmy Well-Known Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

buik “The best traveler is one without a camera.”

eva2000 Administrator Staff Member

buik “The best traveler is one without a camera.”

eva2000 Administrator Staff Member

buik “The best traveler is one without a camera.”

.

Log in / Register

Useful Searches

Join the community today

SSL SSL Business... GAME ON!

Jimmy Well-Known Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

buik “The best traveler is one without a camera.”

eva2000 Administrator Staff Member

buik “The best traveler is one without a camera.”

eva2000 Administrator Staff Member

buik “The best traveler is one without a camera.”

.