SSL Google nullifies all Symantec EV SSL Certificates

eva2000 · Mar 25, 2017

Wow this is huge news in SSL certificate world in that Google has punished Symantec by nullifying all Symantec EV (Extended Validation) SSL certificates Google takes Symantec to the woodshed for mis-issuing 30,000 HTTPS certs [updated] !

In a severe rebuke of one of the biggest suppliers of HTTPS credentials, Google Chrome developers announced plans to drastically restrict transport layer security certificates sold by Symantec-owned issuers following the discovery they have allegedly mis-issued more than 30,000 certificates.

Effective immediately, Chrome plans to stop recognizing the extended validation status of all certificates issued by Symantec-owned certificate authorities, Ryan Sleevi, a software engineer on the Google Chrome team, said Thursday in an online forum. Extended validation certificates are supposed to provide enhanced assurances of a site's authenticity by showing the name of the validated domain name holder in the address bar. Under the move announced by Sleevi, Chrome will immediately stop displaying that information for a period of at least a year. In effect, the certificates will be downgraded to less-secure domain-validated certificates.
Click to expand...

and eventually all Symantec SSL certificates will meet a similar fate !

More gradually, Google plans to update Chrome to effectively nullify all currently valid certificates issued by Symantec-owned CAs. With Symantec certificates representing more than 30 percent of the Internet's valid certificates by volume in 2015, the move has the potential to prevent millions of Chrome users from being able to access large numbers of sites. What's more, Sleevi cited Firefox data that showed Symantec-issued certificates are responsible for 42 percent of all certificate validations. To minimize the chances of disruption, Chrome will stagger the mass nullification in a way that requires they be replaced over time. To do this, Chrome will gradually decrease the "maximum age" of Symantec-issued certificates over a series of releases. Chrome 59 will limit the expiration to no more than 33 months after they were issued. By Chrome 64, validity would be limited to nine months.
Click to expand...

eva2000 · Mar 25, 2017

Google Groups

Summary

Since January 19, the Google Chrome team has been investigating a series of failures by Symantec Corporation to properly validate certificates. Over the course of this investigation, the explanations provided by Symantec have revealed a continually increasing scope of misissuance with each set of questions from members of the Google Chrome team; an initial set of reportedly 127 certificates has expanded to include at least 30,000 certificates, issued over a period spanning several years. This is also coupled with a series of failures following the previous set of misissued certificates from Symantec, causing us to no longer have confidence in the certificate issuance policies and practices of Symantec over the past several years. To restore confidence and security of our users, we propose the following steps:

A reduction in the accepted validity period of newly issued Symantec-issued certificates to nine months or less, in order to minimize any impact to Google Chrome users from any further misissuances that may arise.

An incremental distrust, spanning a series of Google Chrome releases, of all currently-trusted Symantec-issued certificates, requiring they be revalidated and replaced.

Removal of recognition of the Extended Validation status of Symantec issued certificates, until such a time as the community can be assured in the policies and practices of Symantec, but no sooner than one year.

Click to expand...

To balance the compatibility risks versus the security risks, we propose a gradual distrust of all existing Symantec-issued certificates, requiring that they be replaced over time with new, fully revalidated certificates, compliant with the current Baseline Requirements. This will be accomplished by gradually decreasing the ‘maximum age’ of Symantec-issued certificates over a series of releases, distrusting certificates whose validity period (the difference of notBefore to notAfter) exceeds the specified maximum.

The proposed schedule is as follows:

Chrome 59 (Dev, Beta, Stable): 33 months validity (1023 days)

Chrome 60 (Dev, Beta, Stable): 27 months validity (837 days)

Chrome 61 (Dev, Beta, Stable): 21 months validity (651 days)

Chrome 62 (Dev, Beta, Stable): 15 months validity (465 days)

Chrome 63 (Dev, Beta): 9 months validity (279 days)

Chrome 63 (Stable): 15 months validity (465 days)

Chrome 64 (Dev, Beta, Stable): 9 months validity (279 days)

The proposed schedule attempts to avoid making changes in Chrome 63 Stable, as that would be released during the winter holiday production freeze many organizations undergo. This is solely to reduce disruption for site operators and users, and attempts to resume with Chrome 64 following the holiday season. Further, the practical impact of the changes in Chrome 59 and 60 are relatively minimal, due to many of the certificates issued during that period of time being issued using SHA-1, which is no longer supported for certificates in Chrome.

In addition, we propose to require that all newly-issued certificates must have validity periods of no greater than 9 months (279 days) in order to be trusted in Google Chrome, effective Chrome 61. This ensures that the risk of any further misissuance is, at most, limited to nine months, and more importantly, that if any further action is warranted or necessary, that the entire ecosystem can migrate within that time period, thus minimizing the risk of further compatibility issues.

By combining these two steps, we can ensure that the level of assurance in Symantec-issued certificates is able to match what is expected by Google Chrome and the ecosystem, and that the risks posed both from past and possible future misissuance is minimized as much as possible.
Click to expand...

buik · Mar 25, 2017

If its good or bad to you, your neighbor or anyone else, it does not matter.
Fact is that Google has become way too powerful.

BamaStangGuy · Mar 25, 2017

bassie said: ↑

If its good or bad to you, your neighbor or anyone else, it does not matter.
Fact is that Google has become way too powerful.
Click to expand...

It is a catch 22 for me. I love it. While I hate monopolies, I feel like they still remain on the better side of morals when it comes to large corporations and they continuously fight against the U.S. surveillance state.

eva2000 · Mar 25, 2017

indeed finding that balance

But seriously Symantec mis-issuing 30,000 EV SSL certificates is crazy - that erodes the trust in the EV SSL process ! How should Symantec be penalised otherwise ?

buik · Mar 25, 2017

eva2000 said: ↑

indeed finding that balance

But seriously Symantec mis-issuing 30,000 EV SSL certificates is crazy - that erodes the trust in the EV SSL process ! How should Symantec be penalised otherwise ?
Click to expand...

True but finding the balance is hard.
Symantec should be penalized but now the genuine consumers are in fact screwed.
Google is the same evil ... like almost all big techies.

It gives a double feeling.
A little bit of: It is a case of the pot calling the kettle black.

eva2000 · Mar 25, 2017

Yeah but I wonder how those companies paying for Symantec EV SSL certificates feel if some 3rd party managed to mis-issue and maliciously use a copy of their domains' EV SSL certificates ? Don't think the article states whether domain validated SSL certs have been mis-issued too though ? As a customer, I'd be moving off Symantec anyway for SSL certs.

buik · Mar 25, 2017

eva2000 said: ↑

As a customer, I'd be moving off Symantec anyway for SSL certs.
Click to expand...

I'm curious how many customers say they go away and then really migrate the infrastructure afterwards.
Symantec/VeriSign SSL is a big fish.

Many large customers like Oracle and Governments with their complex solutions depends on Symantec/VeriSign SSL.
You could migrate website SSL certs easy peasy but it does not apply of course to complex authentication mechanisms.

Revenge · Mar 25, 2017

bassie said: ↑

Many large customers like Oracle and Governments with their complex solutions depends on Symantec/VeriSign SSL.
You could migrate website SSL certs easy peasy but it does not apply of course to complex authentication mechanisms.
Click to expand...

Chrome is giving more than a year. Its more than enough for them to change to a more reliable company that issues certificates.

Jimmy · Mar 25, 2017

Google has every right to do what they want with their product.

Looking at the update to the org article Google takes Symantec to the woodshed for mis-issuing 30,000 HTTPS certs [updated] it might've been just a warning shot as they're both working together to resolve the issue.

buik · Mar 25, 2017

Revenge said: ↑

Chrome is giving more than a year. Its more than enough for them to change to a more reliable company that issues certificates.
Click to expand...

1 year is actual not that much.
It's all about politics in cases like this.
Nothing about the actual solutions created by engineers.

Google’s statements about our issuance practices and the scope of our past mis-issuances are exaggerated and misleading. For example, Google’s claim that we have mis-issued 30,000 SSL/TLS certificates is not true. In the event Google is referring to, 127 certificates – not 30,000

– were identified as mis-issued, and they resulted in no consumer harm. We have taken extensive remediation measures to correct this situation, immediately terminated the involved partner’s appointment as a registration authority (RA), and in a move to strengthen the trust of Symantec-issued SSL/TLS certificates, announced the discontinuation of our RA program.

While all major CAs have experienced SSL/TLS certificate mis-issuance events, Google has singled out the Symantec Certificate Authority in its proposal even though the mis-issuance event identified in Google’s blog post involved several CAs.
Click to expand...

Symantec Backs Its CA

eva2000 · Mar 25, 2017

Will be interesting to see how this all plays out either way !

eva2000 · Mar 29, 2017

wow Symantec just put their foot in their mouth again http://thehackernews.com/2017/03/symantec-ssl-certificates.html

A security researcher has disclosed critical issues in the processes and third-party API used by Symantec certificate resellers to deliver and manage Symantec SSL certificates.

The flaw, discovered by Chris Byrne, an information security consultant and instructor for Cloud Harmonics, could allow an unauthenticated attacker to retrieve other persons' SSL certificates, including public and private keys, as well as to reissue or revoke those certificates.

Even without revoking and reissuing a certificate, attackers can conduct "man-in-the-middle" attack over the secure connections using stolen SSL certs, tricking users into believing they are on a legitimate site when in fact their SSL traffic is being secretly tampered with and intercepted.
Click to expand...

and to make it worse Symantec knew of this since 2015!

Symantec knew of API Flaws Since 2015

Byrne said he first discovered the issues surrounding Symantec certificates in 2015 and agreed to "limited non-disclosure," as Symantec said the company would take nearly two years to fix the problems.
Click to expand...

eva2000 · Apr 29, 2017

Pretty please from Symantec Peace in our time! Symantec says it can end Google cert spat

eva2000 · May 8, 2017

Google Groups

still an uphill battle it seems

I'm posting this on behalf of Symantec:

We would like to update the community about our ongoing dialogue with Google.

Following our May 4th post, senior executives at Google and Symantec established a new dialogue with the intention to arrive at a new proposal for the community that addresses the substantial customer impact that would result from prior proposals. We urge Symantec customers and the browser community to pause on decisions related to this matter until final proposals are posted and accepted. The intent of both Google and Symantec is to arrive at a proposal that improves security while minimizing business disruption across the community.

We want to reassure the community that we are taking these matters and the impact on the community very seriously.
Click to expand...

eva2000 · Sep 12, 2017

The end is near for Symantec ssl certificates Google to kill Symantec certs in Chrome 66, due in early 2018

Google has detailed its plan to deprecate Symantec-issued certificates in Chrome.

The decision to end-of-life its trust for Symantec certificates was the outcome of a long tussle over dodgy certificates, which came to a head when certs for example.com and various permutations of test.com escaped into the wild.

The absolute end-of-trust date is still some way off, in March 2018, but in this post, Google fills in many of the steps between now and then.

By the death-note date, all Symantec-issued TLS certificates older than June 1, 2016 must be replaced.

Chrome will distrust those certificates as of version 66 - due around March or April 2018, but Google's going to start adding warnings from Chrome 62 which should land in October 2017.
Click to expand...

Andy · Nov 9, 2017

What SSL cert are you recommending George? I got my SSL from RapidSSL which is affected.
Is it better to get a commercial ssl or just the free cert that can be generated with the centmin script?

eva2000 · Nov 9, 2017

As I resell paid SSL certificates, I provide my own for my own sites as well for Premium members Premium User Membership Explained (was at a discount back end though prices have come down on retail but not on wholesale heh).

GGSSL/Comodo branded paid SSL certs but I only use paid SSL wildcard certs for *.domain.com as I has 100s of subdomains all covered by 1x SSL wildcard cert works out quite cheaply for ~US$40-80/yr

But Centmin Mod free letsencrypt SSL certs do just fine too if you need domain validated (not wildcard ssl) SSL certs. Letsencrypt in Jan 2018 will start offering SSL wildcard certs too

For existing Centmin Mod sites on 123.09beta01 Migrating Existing Nginx Vhost From HTTP to HTTP/2 based HTTPS With Letsencrypt SSL Certificates - you'd skip steps 7, 8 and 9 as you already have HTTPS default site and step 6 only need to replace your ssl cert and key paths with letsencrypt ones

deltahf · Dec 6, 2017

Just a friendly reminder to Centminmod users that starting December 1, if you used a certificate with a Symantec root certificate then Chrome's Inspector console shows the following warning on all of your pages:

Here is the link referenced in this warning.

I use RapidSSL, which used the Symantec root certificate, so this started happening on my site. To resolve, I just signed in to my GoGetSSL account and used their tools to re-issue my certificate. I then re-installed the certificate using my own SSL certificate re-installation guide (which now has over 2,100 views, I guess from Google searches, woo! ).

eva2000 · Dec 7, 2017

thanks for heads up and yup your guide has some visitors

Log in / Register

Forums

Join the community today

SSL Google nullifies all Symantec EV SSL Certificates

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

buik “The best traveler is one without a camera.”

BamaStangGuy Active Member

eva2000 Administrator Staff Member

buik “The best traveler is one without a camera.”

eva2000 Administrator Staff Member

buik “The best traveler is one without a camera.”

Revenge Active Member

Jimmy Well-Known Member

buik “The best traveler is one without a camera.”

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

Andy Active Member

eva2000 Administrator Staff Member

deltahf Premium Member Premium Member

eva2000 Administrator Staff Member

.

Log in / Register

Useful Searches

Join the community today

SSL Google nullifies all Symantec EV SSL Certificates

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

buik “The best traveler is one without a camera.”

BamaStangGuy Active Member

eva2000 Administrator Staff Member

buik “The best traveler is one without a camera.”

eva2000 Administrator Staff Member

buik “The best traveler is one without a camera.”

Revenge Active Member

Jimmy Well-Known Member

buik “The best traveler is one without a camera.”

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

Andy Active Member

eva2000 Administrator Staff Member

deltahf Premium Member Premium Member

eva2000 Administrator Staff Member

.