Remind HN: Chrome 57 Doesn't Trust StartCom or WoSign

TL;DR: If you still have StartCom or WoSign certs, you should update them yesterday.

Chrome 57 now reports the big scary "Your connection is not private" message for most StartCom or WoSign sites. This includes, "Attackers might be trying to steal your information," with the code NET::ERR_CERT_AUTHORITY_INVALID.

Even if users click Advanced→Proceed... to continue anyway, any cross-domain StartCom/WoSign requests will simply fail with net::ERR_INSECURE_RESPONSE (status 0).

In Chrome 56, this only applied to certificates issued after Oct 21, 2016, but starting in Chrome 57, it applies to all sites that are not part of the Alexa 1M, regardless of when the certificate was issued.

Unfortunately, it's not part of the Chrome release notes. The best resource I found on the issue was at https://forums.whirlpool.net.au/archive/2605051. It refers to this commit:

    commit	e719fc626a3b9a528bf226b704785bcb24d07868	
    author	Ryan Sleevi <rsleevi@chromium.org>	Fri Jan 27 21:14:49 2017
    committer	Ryan Sleevi <rsleevi@chromium.org>	Fri Jan 27 21:14:49 2017
    Restrict the set of WoSign/StartCom certs to the Alexa Top 1M
    Restrict the set of domains for which WoSign/StartCom certificates
    are trusted to the set of domains intersecting the Alexa Top 1M
    whose certificates are unexpired and unrevoked.
    BUG=685826

If you've been putting off your updates since the earlier discussions[1][2][3][4][5], then it's time to kick it into high gear and update your certs.

If you missed all that, https://wiki.mozilla.org/CA:WoSign_Issues enumerates the issues, and https://security.googleblog.com/2016/10/distrusting-wosign-and-startcom.html summarizes it at a high level.

    [1] https://news.ycombinator.com/item?id=12389573
    [2] https://news.ycombinator.com/item?id=12444590
    [3] https://news.ycombinator.com/item?id=12617659
    [4] https://news.ycombinator.com/item?id=12787029
    [5] https://news.ycombinator.com/item?id=12841860