Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate

sslmate.com

Post reply on HN
Print view View original

31–40 of 95 posts

Re: Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate

#31

Post by jakobbuis »

freehunter wrote: post #16
robertelder wrote: post #4

I'm using Chromium on Ubuntu 16, and I've been trying to visit https://www.nist.gov/ but I don't even get an option to 'browse insecurely' under the 'Advanced' link. In my experience that past couple days, I get the warning on about 10-25% of major web sites.

Ugh that's the worst. I work on servers where the GUI can only be accessed using HTTPS, but its all internal so many clients don't bother. And I don't know why browsers sometimes don't let me say "continue anyway" but it's super frustrating.

Using HSTS on a website will generally prevent your browser from allowing you to continue, which is fair: the website owner has explicitly indicated the website should only ever be used over a encrypted connection, and that is not the case..

Re: Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate

#32

Post by bradleyjg »

agwa wrote: post #22

Author here. It has gotten kind of hard to follow what has happened, so here's a chronology: 1. In September, Chrome 53 was released, which enabled mandatory Certificate Transparency for Symantec certificates due to Symantec's history of incompetence. Some website operators, such as Chase, asked Symantec to submit their certificates to Certificate Transparency logs in such a way that the certificate wouldn't be trust…

The Chrome team was able to fix this within 24 hours by remotely disabling CT enforcement in Chrome. (When Chrome starts up, it fetches a list of feature flags from a Chrome server using a system called Finch which is independent of the normal upgrade system.)

After reading the blogpost, it seems like it was working as intended. Why "fix" it?

Re: Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate

#33

Post by JoshTriplett »

swalsh wrote: post #24
agwa wrote: post #22

Author here. It has gotten kind of hard to follow what has happened, so here's a chronology: 1. In September, Chrome 53 was released, which enabled mandatory Certificate Transparency for Symantec certificates due to Symantec's history of incompetence. Some website operators, such as Chase, asked Symantec to submit their certificates to Certificate Transparency logs in such a way that the certificate wouldn't be trust…

Is there any reason, in 2016, to use Symantec over LetsEncrypt?

Wildcards.

Re: Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate

#35

Post by pilom »

JoshTriplett wrote: post #33
swalsh wrote: post #24

Earlier quoted context omitted.

Is there any reason, in 2016, to use Symantec over LetsEncrypt?

Wildcards.

We use wildcard certs for a number of domains to support affiliate subdomains. So affiliate.example.com and affiliate2.example.com are all served by the same servers and thus all need to validate with one cert.

Re: Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate

#36

Post by paulddraper »

jakobbuis wrote: post #31
freehunter wrote: post #16

Earlier quoted context omitted.

Ugh that's the worst. I work on servers where the GUI can only be accessed using HTTPS, but its all internal so many clients don't bother. And I don't know why browsers sometimes don't let me say "continue anyway" but it's super frustrating.

Using HSTS on a website will generally prevent your browser from allowing you to continue, which is fair: the website owner has explicitly indicated the website should only ever be used over a encrypted connection, and that is not the case..

I understand who owns the website.

Who owns my browser?

Re: Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate

#37

Post by du_bing »

I am in China, when I open baidu.com, zhihu.com, Chromium will throw the private error. There is an interesting solution, on the page of private error, input "badidea", the browser will automaticly redirect to the targeted website. But it may be a "bad idea". Now I use Firefox to open these sites.

Re: Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate

#38

Post by duaneb »

agwa wrote: post #22

Author here. It has gotten kind of hard to follow what has happened, so here's a chronology: 1. In September, Chrome 53 was released, which enabled mandatory Certificate Transparency for Symantec certificates due to Symantec's history of incompetence. Some website operators, such as Chase, asked Symantec to submit their certificates to Certificate Transparency logs in such a way that the certificate wouldn't be trust…

> by remotely disabling CT enforcement in Chrome

A) why is this possible, and B) isn't the whole point of the expiring list to provide a stick? Why remove the stick at the last moment?

Re: Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate

#39

Post by duaneb »

pilom wrote: post #35
JoshTriplett wrote: post #33

Earlier quoted context omitted.

Wildcards.

We use wildcard certs for a number of domains to support affiliate subdomains. So affiliate.example.com and affiliate2.example.com are all served by the same servers and thus all need to validate with one cert.

You can use SAN certificates to avoid wildcards while still validating for a number of domains.

They don't even need to be subdomains.

Re: Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate

#40

Post by NeutronBoy »

swalsh wrote: post #24
agwa wrote: post #22

Author here. It has gotten kind of hard to follow what has happened, so here's a chronology: 1. In September, Chrome 53 was released, which enabled mandatory Certificate Transparency for Symantec certificates due to Symantec's history of incompetence. Some website operators, such as Chase, asked Symantec to submit their certificates to Certificate Transparency logs in such a way that the certificate wouldn't be trust…

Is there any reason, in 2016, to use Symantec over LetsEncrypt?

For small startups, probably not. Large organisations have far more stringent processes around certificates. Auditing, validation, testing, regulatory requirements, EV, support contracts and SLAs, etc.
Post reply on HN