[deleted]
Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates
11–20 of 329 posts
Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates
#12Earlier quoted context omitted.
Pretty much it will decide the question on whether or not the certificate system is even workable. My thesis is that either Symantec will not be able to respond (and so lose their ability to be a root certificate) in which case it will warn other root cert authorities to shape up or lose their business, or they will placate the Google and Chromium teams somehow and show that root cert authorities can be brought to be…
I think it's likelier that Symantec will start a negative PR campaign, leading its users to yell at google to change things, perhaps calling this FUD. Whether that'll be effective is another question.
It would be pointless. Who would listen?
The general public doesn't care about inside baseball. Site operators can't afford not to work perfectly with Chrome.
Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates
#13> Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates When I read that something like this popped up in my head: "Google is using the nuclear option on Symantec. Neat!"
Perhaps it's neat for you, I just found out that our newly issued EV certificate status is being revoked in the next build of Chrome, so our expensive EV certificates may as well be $5 StartSSL certificates. I imagine that there will be a lot of angry customers asking for refunds from Symantec/Verisign for certificates already issued which no longer conform to the offered product.
How recently did you renew? This has been in the works for over two years,I'm surprised that anyone is still giving them business.
Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates
#14Earlier quoted context omitted.
Perhaps it's neat for you, I just found out that our newly issued EV certificate status is being revoked in the next build of Chrome, so our expensive EV certificates may as well be $5 StartSSL certificates. I imagine that there will be a lot of angry customers asking for refunds from Symantec/Verisign for certificates already issued which no longer conform to the offered product.
How recently did you renew? This has been in the works for over two years,I'm surprised that anyone is still giving them business.
We renewed recently, through our hosting provider who have Symantec in their certificate chain.
Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates
#15> Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates When I read that something like this popped up in my head: "Google is using the nuclear option on Symantec. Neat!"
Perhaps it's neat for you, I just found out that our newly issued EV certificate status is being revoked in the next build of Chrome, so our expensive EV certificates may as well be $5 StartSSL certificates. I imagine that there will be a lot of angry customers asking for refunds from Symantec/Verisign for certificates already issued which no longer conform to the offered product.
I for one find it totally neat that people realize their expensive EV cert was a waste of money. Although that was true before, too. EV certs are a waste of money, the only thing they do is show a green bar. They don't improve security.
Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates
#16TLDR: Google has lost trust in Symantec's ability to properly validate certificates they issue. Chrome has a Root Certificate Policy that expects a CA to perform in a manner commensurate with the trust being placed in them and the Google team appears to see evidence that they are not living up to the standard laid out.
They propose a gradual distrust of existing certificates by reducing the 'maximum age' of the certificates with each release of Chrome.
EV certificates are proposed to have their EV indicators stripped immediately until Symantec, for one year, demonstrates sustained compliance.
Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates
#17Google's also been looking to limit the maximum validity lifetimes in general through the CA/B Forum[1] in a ballot that ended up not passing (with hints[2] that Chrome would end up enforcing something similar itself even if it wasn't part of the Baseline Requirements).
This seems to be indicative of the general indication that Chrome wants to head in anyway[3].
[1] https://cabforum.org/pipermail/public/2017-January/009373.ht...
[2] https://cabforum.org/pipermail/public/2017-February/009746.h... - there was a more explicit post elsewhere but I can't find it in the archives right now
Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates
#18Earlier quoted context omitted.
Perhaps it's neat for you, I just found out that our newly issued EV certificate status is being revoked in the next build of Chrome, so our expensive EV certificates may as well be $5 StartSSL certificates. I imagine that there will be a lot of angry customers asking for refunds from Symantec/Verisign for certificates already issued which no longer conform to the offered product.
I for one find it totally neat that people realize their expensive EV cert was a waste of money. Although that was true before, too. EV certs are a waste of money, the only thing they do is show a green bar. They don't improve security.
Absolutely, I totally get that, it's worth mentioning that we take our TLS implementation seriously (HSTS, no TLS1.0, etc) and score an A+ on SSLLabs test: http://i.imgur.com/QbH4YZS.png
The green bar with our company name in it translated in to a measurable conversion increase week for week from guest checkouts, so saying it's a waste of money isn't strictly true in our case.
Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates
#19> Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates When I read that something like this popped up in my head: "Google is using the nuclear option on Symantec. Neat!"
Perhaps it's neat for you, I just found out that our newly issued EV certificate status is being revoked in the next build of Chrome, so our expensive EV certificates may as well be $5 StartSSL certificates. I imagine that there will be a lot of angry customers asking for refunds from Symantec/Verisign for certificates already issued which no longer conform to the offered product.
[deleted]
Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates
#20Earlier quoted context omitted.
Perhaps it's neat for you, I just found out that our newly issued EV certificate status is being revoked in the next build of Chrome, so our expensive EV certificates may as well be $5 StartSSL certificates. I imagine that there will be a lot of angry customers asking for refunds from Symantec/Verisign for certificates already issued which no longer conform to the offered product.
I for one find it totally neat that people realize their expensive EV cert was a waste of money. Although that was true before, too. EV certs are a waste of money, the only thing they do is show a green bar. They don't improve security.
It proves (if the issuer has done their job) that the organisation requesting the certificate has been properly vetted, so you’re more likely to be doing business with the right website.