Do you have a Symantec Certificate?

8 January 2018

Chrome’s distrust in Symantec Certificates

During July last year, the Google Chrome team, together with the PKI community diverged a strategy to not only reduce, but also to remove confidence in Symantec’s current certificates. During the previous 18 months, Google has repeatedly opposed the way that Symantec issues TLS (Transport Layer Security) certificates, with Symantec pledging to do better. This followed various incidents implemented by Symantec Corporation’s PKI businesses, who issued several dubious authentication certificates that did not meet the obligations of the CA/Browser Forum Baseline requirements.

The Symantec Corporation, operating various Certificate Authorities, under numerous brand names, including RapidSSL, GeoTrust, Equifax, VerisSign and Thawte were subject to an investigation, which concluded that Symantec has assigned various organisations with the capability of issuing certificates, without the necessary or appropriate management, even though they had been conscious of these security shortcomings for some time. This was brought to the attention of the public following a posting to the newsgroup,

Plan to uphold users’ privacy and security

The PKI community and the Google Chrome Team diverged their plan at the end of July 2017, to not only decrease, but also to finally remove, trust in Symantec’s organisation, in order to sustain privacy and security for any users browsing the web. Following a significant debate by members of the blink-dev forum, they devised a plan which would allow sufficient time to transition to a Managed Partner Infrastructure that would operate independently, allowing Symantec time to redesign and modernise its organisation, to comply with industry standards. So commenced the timeline to achieve this goal, detailing when site administrators may require new certificates.

Operations teams, network administrators and security teams have busy times ahead, with the process detailed in 3 clear-cut phases:

  1. After December 2017 – No trust in any certificates issued from Symantec’s legacy infrastructure.
  2. Prior to June 2016 – No trust in any certificates issued from Symantec’s legacy infrastructure
  3. No trust in any certificates issues from Symantec’s legacy infrastructure

The first phase will roll out on March 15, 2018 with Chrome Beta Version 66. Following this, Chrome 70 will release around October 23, 2018, which will totally remove trust in Symantec’s old infrastructure and any previous certificates issued by them.

Viva Digital would like to assure our hosted customers that they are not affected at all by this, as we use other certificate providers, of which are unaffected by this issue.

If you need any help or advice for your own digital strategy, simply get in touch! You can also follow Viva Digital on Facebook to receive regular news, tips and how-tos in your feed. Thanks for reading.

Paul Smith

Paul Smith

With more than 20 years of industry experience in the UK, USA and Australia under his belt, Paul Smith is a seasoned professional who will infuse your digital marketing with his wealth of knowledge and expertise. Paul specialises in digital strategy, SEO and data analytics.