Hacker News Reader

Comment by AndrewDucker | Hacker News Reader

Chrome doing likewise: https://security.googleblog.com/2018/03/distrust-of-symantec...

Apple¹ and Mircosoft² are doing the same. Additionally anything that uses Chromium's trustlists (Vivaldi, Electron, etc) will also distrust old Symantec & co's certs.

1: https://support.apple.com/en-us/HT208860 2: https://knowledge.digicert.com/alerts/ALERT2562.html

EDIT: Its also worth mentioning that this isn't just limited Symantec certs but also will include GeoTrust, thawte, & VeriSign certs. Symantec's cert business has now been taken over by DigiCert so there is a means for valid reassurance.

EDIT2: Also it will effect RapidSSL. Totally forgot about them.

Chrome did this first, so any wide effect (in yall's organsiations) should already have been noticed by now, due to this.

As I understand it, Chrome and Firefox are both operating under the same policies with about the same timetables. Full distrust doesn't come until Firefox 63 / Chrome 70 - neither of which are stable releases yet.

The limited distrust (for older certs issued prior to June 2016) was activated in Firefox 60 and Chrome 66 much earlier this year.

That's factually incorrect.

Google blacklisted ALL Symantec certificates since Chrome 66, in April. The roadmap announced the change for October but they did it 6 months earlier, ignoring their own roadmap.

As the OP says, organizations using Symantec have already been hit very hard, by surprise.

Do you have a source for that? Google's KB articles still reference Chrome 70 [1], and I can't find another reference to this anywhere else.

Paypal.com is still operating with a Symantec signed cert - issued by "Symantec Class 3 EV SSL CA - G3". Works fine in Chrome 68. (and not in Firefox with the security.pki.distrust_ca_policy override set)

[1] https://support.google.com/chrome/a/answer/7662561?hl=en

I worked at a large company whose sole supplier was Symantec. Everything has been blacklisted since April.

Similar environment except for the blacklisting didn’t happen to us. Any chance some wires were crossed and someone pushed out a policy explicitly distrusting the CA?

I think a source implies an authoritative source and not an anecdotal source.

Yeah. Not true. I visit many sites with Symantec certs in Chrome 69 that don't work in Chrome 70

This isn't true. Chrome itself proves this when loading a site affected by wave 2 of the distrust:

"The SSL certificate used to load resources from https://(domain) will be distrusted in M70. Once distrusted, users will be prevented from loading these resources. See https://g.co/chrome/symantecpkicerts for more information."

Everything was being done in 2 waves. First wave was Chrome 66, second wave is Chrome 70. See Google's link above for the specifics.

Source: Chrome's own warnings and that I work for a business that deals heavily in SSL sales.

Reply on news.ycombinator.com