21–30 of 100 posts
This deprecation policy appears to affect some (possibly all) Startcom SSL certificates, which are chained through "StartCom Class 1 Primary Intermediate Server CA", which is signed with SHA1 and expires on 2017-10-24.
It specifically says the dates apply to the end entity . They're not trying to get people off SHA1 in a couple months, they're trying to get them off in a year or two.
This deprecation policy appears to affect some (possibly all) Startcom SSL certificates, which are chained through "StartCom Class 1 Primary Intermediate Server CA", which is signed with SHA1 and expires on 2017-10-24.
It specifically says the dates apply to the end entity . They're not trying to get people off SHA1 in a couple months, they're trying to get them off in a year or two.
As someone who administers some servers that are affected by this, I'm annoyed, because I now have a new project that has to be done within the next 6 months.
Earlier quoted context omitted.
It specifically says the dates apply to the end entity . They're not trying to get people off SHA1 in a couple months, they're trying to get them off in a year or two.
It also says "[...] which include a SHA-1-based signature as part of the certificate chain". In other words, SHA1 is deprecated in the entire chain (minus the root, where the signature is irrelevant).
This deprecation policy appears to affect some (possibly all) Startcom SSL certificates, which are chained through "StartCom Class 1 Primary Intermediate Server CA", which is signed with SHA1 and expires on 2017-10-24.
Yes, this is going to further insecure the Internet by forcing people back to the for-pay CAs, unless Startcom manages to fix it basically instantly and forces everyone to get new certs, very very quickly.
The problem i have with their "neutral, lacking security" icon is that it does not indicate that anything is wrong when in fact there is. https:// should never have a neutral icon. it should be VALID or INVALID.
Earlier quoted context omitted.
Yes, this is going to further insecure the Internet by forcing people back to the for-pay CAs, unless Startcom manages to fix it basically instantly and forces everyone to get new certs, very very quickly.
Nope, free certificates don't have expiration dates in 2016 or 2017 or later.
This deprecation policy appears to affect some (possibly all) Startcom SSL certificates, which are chained through "StartCom Class 1 Primary Intermediate Server CA", which is signed with SHA1 and expires on 2017-10-24.
It specifically says the dates apply to the end entity . They're not trying to get people off SHA1 in a couple months, they're trying to get them off in a year or two.
If you have a one year certificate (and I always recommend getting one year certificates so that these issues don't affect you and so that renewal becomes an annual chore, not an irregular panic) then you don't have to worry.
StartSSL simply need to cut new intermediates, signed with SHA-256, and provide them to customers once the leaf certificates that they issue start to stretch into 2016.
At CloudFlare, we have a plan to handle this gracefully for our customers (with both modern Chrome and old OSs) ahead of the change, but it's a non-trivial engineering challenge that many organizations won't make. I worry that, faced with the choice above, many organizations will simply opt not to support HTTPS at all. And, from my vantage point, that's a bigger risk to web security today than certificates signed with a SHA1 hash.
Mozilla and IE should adopt similar policies, and not just for SHA1 deprecation, but for other weak security protocols, too. If website A uses much weaker security than website B, they shouldn't be treated equally by the browser. Reward the ones who embrace stronger security, punish (within reason, and gradually) those who don't.