Chrome won't trust Symantec-backed SSL as of Jun 1 unless they account for bogus certs

lotuseclat79 · Nov 1, 2015

Chrome won't trust Symantec-backed SSL as of Jun 1 unless they account for bogus certs

As Google has dug deeper into Symantec's certificate issuance, they've found many bogus certs, triggering an internal audit by Symantec that found literally thousands of "misissued" certificates. Google has announced that as of June 1 2016, it will no longer honor certificates from Symantec unless Symantec becomes a full participant in Certificate Transparency, on the basis that its sloppiness makes its certs intrinsically untrustworthy without the ability of third parties to have complete transparency into Symantec's cert issuance.
Click to expand...

-- Tom

Gullible Jones · Nov 1, 2015

On the one hand, good.

On the other... Pot vs. kettle, anyone?

itman · Nov 1, 2015

Also contrary to Symantec's claims these cert's were contained in their lab i.e. "internal testing," they were discovered "in the wild" by Google: http://tech.slashdot.org/story/15/0...diary-thawte-issues-rogue-google-certificates

BoerenkoolMetWorst · Nov 2, 2015

Symantec performed another audit and, on October 12th, announced that they had found an additional 164 certificates over 76 domains and 2,458 certificates issued for domains that were never registered.
Click to expand...

https://googleonlinesecurity.blogspot.nl/2015/10/sustaining-digital-certificate-security.html

Minimalist · Jan 20, 2017

A security researcher has unearthed evidence showing that three browser-trusted certificate authorities owned and operated by Symantec improperly issued more than 100 unvalidated transport layer security certificates. In some cases, those certificates made it possible to spoof protected HTTPS-protected websites.
Click to expand...

http://arstechnica.com/security/201...antec-issues-more-illegit-https-certificates/

itman · Jan 20, 2017

Minimalist said: ↑

http://arstechnica.com/security/201...antec-issues-more-illegit-https-certificates/
Click to expand...

Not too good for Chrome users ...........

Chrome doesn't [immediately] check certificate revocation, so a revoked certificate can be used in an attack just as easily as an unrevoked certificate," Ayer told Ars. "By default, other browsers fail open and accept a revoked certificate as legitimate if the attacker can successfully block the browser from contacting the revocation server."

Minimalist · Jan 28, 2017

Symantec CA report offers more clarity on certificate transparency catch

According to a statement Symantec provided to SearchSecurity, "CrossCert, a WebTrust audited Registration Authority partner in Korea, overrode compliance failure flags and issued certificates in violation of Symantec policy and CA/B Forum Baseline Requirements. After becoming aware of this issue, Symantec immediately disabled all issuance privileges for CrossCert and revoked any valid and active certificates. Symantec has taken over validation and issuance for all pending and new orders submitted through CrossCert. Additionally, Symantec is reviewing all its RA partners to ensure they are in compliance with our controls and procedures. Our investigation remains on-going."
Click to expand...

http://searchsecurity.techtarget.co...ore-clarity-on-certificate-transparency-catch

Minimalist · Mar 24, 2017

Google takes Symantec to the woodshed for mis-issuing 30,000 HTTPS certs

In a severe rebuke of one of the biggest suppliers of HTTPS credentials, Google Chrome developers announced plans to drastically restrict transport layer security certificates sold by Symantec-owned issuers following the discovery they have issued more than 30,000 certificates.

Effective immediately, Chrome plans to stop recognizing the extended validation status of all certificates issued by Symantec-owned certificate authorities, Ryan Sleevi, a software engineer on the Google Chrome team, said Thursday in an online forum. Extended validation certificates are supposed to provide enhanced assurances of a site's authenticity by showing the name of the validated domain name holder in the address bar. Under the move announced by Sleevi, Chrome will immediately stop displaying that information for a period of at least a year. In effect, the certificates will be downgraded to less-secure domain-validated certificates.
Click to expand...

https://arstechnica.com/security/20...e-woodshed-for-mis-issuing-30000-https-certs/

Minimalist · Apr 27, 2017

Symantec Offers Collaborative Proposal to End Google Spat

Symantec has put forward a series of proposals designed to resolve a long-running dispute with Google over trust in its certificate business, claiming the latter’s plans could have a significant negative impact on major customers.
These included a motion to: reduce the accepted validity period of newly issued Symantec-issued certificates to nine months or less, require the re-validation and replacement of all currently-trusted Symantec-issued certificates and temporarily remove EV status for all Symantec-issued certs, for at least a year.
Click to expand...

https://www.infosecurity-magazine.com/news/symantec-claims-offers/

Minimalist · May 3, 2017

Mozilla takes a turn slapping Symantec's certification SNAFU

Mozilla has weighed in to the ongoing Symantec-Google certificate spat, telling Symantec it should follow the Alphabet subsidiary's advice on how to restore trust in its certificates.
Click to expand...

https://www.theregister.co.uk/2017/05/03/mozilla_backs_google_in_symantec_cert_dispute/

Log in or Sign up

Chrome won't trust Symantec-backed SSL as of Jun 1 unless they account for bogus certs

lotuseclat79 Registered Member

Gullible Jones Registered Member

itman Registered Member

BoerenkoolMetWorst Registered Member

Minimalist Registered Member

itman Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Log in or Sign up

Chrome won't trust Symantec-backed SSL as of Jun 1 unless they account for bogus certs

lotuseclat79 Registered Member

Gullible Jones Registered Member

itman Registered Member

BoerenkoolMetWorst Registered Member

Minimalist Registered Member

itman Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Useful Searches