{"id":33086,"date":"2017-12-06T17:20:04","date_gmt":"2017-12-06T15:20:04","guid":{"rendered":"https:\/\/blog.superhosting.bg?p=33086"},"modified":"2022-02-17T15:35:20","modified_gmt":"2022-02-17T13:35:20","slug":"chrome-firefox-to-distrust-symantec-ssl-in-2018","status":"publish","type":"post","link":"https:\/\/blog.superhosting.bg\/en\/chrome-firefox-to-distrust-symantec-ssl-in-2018.html","title":{"rendered":"Chrome and Firefox to Distrust Symantec&#8217;s SSL Certificates by the End of 2018"},"content":{"rendered":"<p>SSL certificates are responsible for ensuring a secure HTTPS connection between the user and a website.<\/p>\n<p>After the HTTPS connection <a title=\"Google Takes the Next Step Towards a More Secure (HTTPS) Web, SuperHosting.BG Also Moves on With AutoSSL | Blog SuperHosting.BG\" href=\"https:\/\/blog.superhosting.bg\/en\/next-step-to-make-the-web-more-secure-and-autossl.html\">has become imperative for every website<\/a>, SSL certificates also need to comply with the existing security requirements and practices in relation to validation and issuance procedures.<\/p>\n<p>As usual, the leading web browser providers \u2013 Google (Chrome) and Mozilla (Firefox) have initiated a significant debate.<\/p>\n<p>Their security teams detected flaws in the SSL certificates issued by one of the leading certifying companies &#8211; Symantec. The flaws are observed in the issuing authority\u2019s infrastructure as obviously there are certain <a title=\"CAs and Browsers worked to develop stricter and more uniform standards for the management of CAs and issuance of SSL Certificates... | cabforum.org\" href=\"https:\/\/cabforum.org\/faq-about-the-baseline-requirements\" target=\"_blank\" rel=\"noopener noreferrer\">standards and practices<\/a> not followed in the issuance and validating processes.<\/p>\n<p>Symantec is a leading certificate issuing authority which uses a few well-renowned brands \u2013 RapidSSL, GeoTrust and Thawte. All certificates issued by these brands are now compromised.<\/p>\n<p>During the discussion of the actions and measures necessary for fixing the flaws, the Symantec SSL certificates\u2019 business <a title=\"What to Expect with the New DigiCert: Welcoming Symantec Customers, Partners, &amp; Employees | digicert.com\" href=\"https:\/\/www.digicert.com\/blog\/digicert-welcoming-symantec-customers-partners-and-employees\" target=\"_blank\" rel=\"noopener noreferrer\">was acquired<\/a> by another leading company in the field \u2013 <a title=\"DigiCert | digicert.com\" href=\"https:\/\/www.digicert.com\" target=\"_blank\" rel=\"noopener noreferrer\">DigiCert<\/a>.<\/p>\n<p>As a leading provider of SSL\/TLS solutions DigiCert will offer up-to-date, fast and secure infrastructure that can comply with all the requirements and standards for the issuance of SSL certificates. After the acquisition of Symantec, DigiCert announced that as of December 1, 2017 all certificates will be reissued trough the new infrastructures as the service will be completely free.<\/p>\n<p>DigiCert is <a title=\"DigiCert Now Validating &amp; Issuing SSL\/TLS Certificates for Symantec Customers | digicert.com\" href=\"https:\/\/www.digicert.com\/blog\/now-validating-issuing-ssl-certificates-for-symantec\" target=\"_blank\" rel=\"noopener noreferrer\">already reissuing certificates for Symantec customers<\/a> as of December 1, 2017. The SSL certificates issued by DigiCert after this date are fully supported and trusted by Chrome and Firefox.<\/p>\n<p>After numerous discussions concerning the compromised certificates, Google and Mozilla set up a strategy for distrusting Symantec.<\/p>\n<p>The strategy\u2019s final goal will be reached when by the end of 2018 the two browser\u2019s latest versions will completely distrust the Symantec certificates.<\/p>\n<h4 class=\"h4-gray01\">Google and Mozilla&#8217;s Strategies for the Symantec Certificates<\/h4>\n<p>Although the two strategies have the same target and final date, their implementation differs a bit.<\/p>\n<p><a title=\"Chrome\u2019s Plan to Distrust Symantec Certificates | security.googleblog.com\" href=\"https:\/\/security.googleblog.com\/2017\/09\/chromes-plan-to-distrust-symantec.html\" target=\"_blank\" rel=\"noopener noreferrer\"><strong>Chrome\u2019s Plan to Distrust Symantec Certificates<\/strong><\/a><\/p>\n<ul>\n<li><strong>Chrome 62<\/strong> (October 2017) allows you to see if there are deficiencies in the certificate and it will be distrusted in Chrome 66; the notification is visible in Dev Tools;<\/li>\n<li><strong>Chrome 66<\/strong> (April 2018) will remove trust in Symantec-issued certificates issued prior to June 1, 2016;<\/li>\n<li><strong>Chrome 70 will be released in October 2018<\/strong> as it will fully remove trust in Symantec\u2019s old infrastructure and all of the certificates it has issued.<\/li>\n<\/ul>\n<p><a title=\"Mozilla\u2019s Plan for Symantec Roots | groups.google.com\" href=\"https:\/\/groups.google.com\/forum\/#!topic\/mozilla.dev.security.policy\/FLHRT79e3XE\" target=\"_blank\" rel=\"noopener noreferrer\"><strong>Mozilla Firefox\u2019s Plan<\/strong><\/a><\/p>\n<ul>\n<li><strong>Firefox 58<\/strong> (January 2018 ): Notices in the Developer Console will warn about Symantec certificates issued before June 1, 2016;<\/li>\n<li><strong>Firefox 60<\/strong> (May 2018): Websites will show an untrusted connection error if they have a certificate issued before June 1, 2016;<\/li>\n<li><strong>Firefox 63 (October 2018)<\/strong>: Distrust of Symantec certificates issued through the old infrastructure.<\/li>\n<\/ul>\n<div class=\"tipsupport06\">Symantec certificates issued <strong>before December 1, 2017<\/strong> will be completely distrusted by Chrome and Firefox <strong>by the end of 2018<\/strong>.<\/div>\n<h4 class=\"h4-gray01\">How to Reissue a Symantec SSL Certificate?<\/h4>\n<div class=\"boxyellowdashedborder01\"><strong>Important<\/strong>: Reissuing is required only for certificates issued before December 1, 2017 by Symantec, GeoTrust, RapidSSL, Thawte. If the issuing authority is different, there is no need to reissue the certificate.<\/div>\n<div class=\"tipsupport04\">There is plenty of time to reissue each compromised certificate by the end of 2018. If the certificate has been purchased from SuperHosting.BG with the brand of Symantec, RapidSSL or Geotrust, you can submit a request for reissuing it by going to your customer profile <strong>SSL Certificates<\/strong> \u2013 <strong>Details<\/strong> -&gt; <strong>Reissue SSL certificate<\/strong>. There is no need to reissue SSL certificates issued after December 1, 2017.<\/div>\n<div class=\"tipsupport04\">All customers of SuperHosting.BG who have purchased compromised certificates are informed in advance by email for this as we already sent reissuing guidelines.<\/div>\n<p>You can submit a request for reissuing your SSL certificate by going to your <a title=\"Client Profile | SuperHosting.BG\" href=\"https:\/\/en.superhosting.bg\/web-hosting-client-profile.php\" target=\"_blank\" rel=\"noopener noreferrer\">customer profile<\/a> and accessing menu <strong>SSL Certificates<\/strong>. Select the <strong>Details<\/strong> option right next to the certificate. Click on <strong>Reissue SSL certificate<\/strong> and follow the steps.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"img-border2 aligncenter wp-image-33091 size-full\" title=\"Reissue a certificate through the client account\" src=\"https:\/\/blog.superhosting.bg\/wp-content\/uploads\/2017\/12\/client-account-ssl-certificate-reissue-en-01-1.png\" alt=\"Reissue a certificate through the client account\" width=\"438\" height=\"48\" srcset=\"https:\/\/blog.superhosting.bg\/wp-content\/uploads\/2017\/12\/client-account-ssl-certificate-reissue-en-01-1.png 438w, https:\/\/blog.superhosting.bg\/wp-content\/uploads\/2017\/12\/client-account-ssl-certificate-reissue-en-01-1-300x33.png 300w, https:\/\/blog.superhosting.bg\/wp-content\/uploads\/2017\/12\/client-account-ssl-certificate-reissue-en-01-1-436x48.png 436w\" sizes=\"auto, (max-width: 438px) 100vw, 438px\" \/><\/p>\n<p>You do not need to enter any information to reissue the certificate. After clicking on <strong>Reissue<\/strong>, you will receive a verification email to confirm reissuing the certificate.<\/p>\n<div class=\"boxyellowdashedborder01\"><strong>Important<\/strong>: Due to the current huge number of requests, DigiCert announced that there might be a slight delay in receiving the verification emails with up to 3 days. After submitting a request for reissuing your certificate, you might need to wait up to three days before receiving the verification email.<\/div>\n<h4><strong>Reinstalling the New SSL Certificate in cPanel<\/strong><\/h4>\n<p>After the certificate has once been issued, you will only need to reinstall it.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"img-border2 alignright wp-image-33095 size-full\" title=\"Install and Manage SSL for your site (HTTPS) in cPanel\" src=\"https:\/\/blog.superhosting.bg\/wp-content\/uploads\/2017\/12\/cpanel-ssl-tls-install-ssl-certificate-for-domain-en-02-1.png\" alt=\"Install and Manage SSL for your site (HTTPS) in cPanel\" width=\"348\" height=\"108\" srcset=\"https:\/\/blog.superhosting.bg\/wp-content\/uploads\/2017\/12\/cpanel-ssl-tls-install-ssl-certificate-for-domain-en-02-1.png 348w, https:\/\/blog.superhosting.bg\/wp-content\/uploads\/2017\/12\/cpanel-ssl-tls-install-ssl-certificate-for-domain-en-02-1-300x93.png 300w\" sizes=\"auto, (max-width: 348px) 100vw, 348px\" \/><\/p>\n<p>If you are using cPanel, you can install the new certificate by going to <strong>SSL\/TLS<\/strong> -&gt; Install and Manage SSL for your site (HTTPS) and click on <strong>Manage SSL sites<\/strong>.<\/p>\n<p>To install a new certificate go to <strong>Install an SSL Website<\/strong>&nbsp;section and select the domain from the drop-down menu. Enter the new code in the following three fields CRT, KEY, CABUNDLE and finish the installation with <strong>Install Certificate<\/strong>. You will see a message that the certificate has been successfully installed.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Reissuing is required only for certificates issued before December 1, 2017 by Symantec, GeoTrust, RapidSSL, Thawte. <\/p>\n","protected":false},"author":16,"featured_media":62893,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"_lmt_disableupdate":"","_lmt_disable":"","footnotes":""},"categories":[126],"tags":[128,367],"class_list":{"0":"post-33086","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-superhosting-news-en","8":"tag-security-and-protection-in-internet","9":"tag-ssl-certificates"},"aioseo_notices":[],"modified_by":"\u041c\u0430\u0434\u043b\u0435\u043d\u0430 \u041c\u0435\u0442\u043e\u0434\u0438\u0435\u0432\u0430","post_mailing_queue_ids":[],"_links":{"self":[{"href":"https:\/\/blog.superhosting.bg\/en\/wp-json\/wp\/v2\/posts\/33086","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.superhosting.bg\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.superhosting.bg\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.superhosting.bg\/en\/wp-json\/wp\/v2\/users\/16"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.superhosting.bg\/en\/wp-json\/wp\/v2\/comments?post=33086"}],"version-history":[{"count":2,"href":"https:\/\/blog.superhosting.bg\/en\/wp-json\/wp\/v2\/posts\/33086\/revisions"}],"predecessor-version":[{"id":62464,"href":"https:\/\/blog.superhosting.bg\/en\/wp-json\/wp\/v2\/posts\/33086\/revisions\/62464"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.superhosting.bg\/en\/wp-json\/wp\/v2\/media\/62893"}],"wp:attachment":[{"href":"https:\/\/blog.superhosting.bg\/en\/wp-json\/wp\/v2\/media?parent=33086"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.superhosting.bg\/en\/wp-json\/wp\/v2\/categories?post=33086"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.superhosting.bg\/en\/wp-json\/wp\/v2\/tags?post=33086"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}