![](\"https:\/\/tctechcrunch2011.files.wordpress.com\/2014\/08\/chrome1.png?w=738\")
<\/p>\n<\/p>\n
Google, which has accused<\/a> Symantec and its partners of misissuing tens of thousands of certificates for encrypted web connections,\u00a0quietly announced Thursday that it\u2019s downgrading the level and length of trust Chrome will place in certificates issued by Symantec.<\/p>\n Encrypted web connections \u2014 HTTPS connections like those on banking sites, login pages or news sites like this one<\/a> \u2014 are enabled\u00a0by Certificate Authorities, which verify the identity of the website owner and issue them a certificate authenticating that they are who they say they are. Think of a Certificate Authority like a passport agency\u00a0and the certificates they issue like passports. Without the CA\u2019s authentication of a website owner\u2019s identity, users can\u2019t trust that the\u00a0site on the other end of their HTTPS connection is really their bank.<\/p>\n Symantec is a giant in the world of CAs \u2014 its certificates vouched for about 30 percent of the web in 2015. But Google claims that Symantec hasn\u2019t been taking its responsibilities<\/a> seriously and has issued at least 30,000 certificates without properly verifying the websites that received them. It\u2019s a serious allegation that undermines the trust users can place in the encrypted web,\u00a0and Google says it will begin the process of distrusting Symantec certificates in its Chrome browser. Symantec lashed out at Google\u2019s claims, calling them \u201cirresponsible\u201d and \u201cexaggerated and misleading.\u201d<\/p>\n \u201cSince January 19, the Google Chrome team has been investigating a series of failures by Symantec Corporation to properly validate certificates. Over the course of this investigation, the explanations provided by Symantec have revealed a continually increasing scope of misissuance with each set of questions from members of the Google Chrome team; an initial set of reportedly 127 certificates has expanded to include at least 30,000 certificates, issued over a period spanning several years,\u201d Google software engineer Ryan Sleevi wrote in a forum post<\/a> outlining the case against Symantec.\u00a0\u201cThis is also coupled with a series of failures following the previous set of misissued certificates from Symantec, causing us to no longer have confidence in the certificate issuance policies and practices of Symantec over the past several years.\u201d<\/p>\n To remedy the situation, Sleevi said that Chrome would reduce the length of time the browser trusts a Symantec-issued certificate and, over time, would require sites to replace old Symantec certificates with newer, trusted ones.<\/p>\n Sleevi said that Symantec\u2019s behavior failed to meet the baseline requirements for a Certificate Authority, creating what he called \u201csignificant risk for Google Chrome users.\u201d He added:<\/p>\n Symantec allowed at least four parties access to their infrastructure in a way to cause certificate issuance, did not sufficiently oversee these capabilities as required and expected, and when presented with evidence of these organizations\u2019 failure to abide to the appropriate standard of care, failed to disclose such information in a timely manner or to identify the significance of the issues reported to them.<\/p>\n These issues, and the corresponding failure of appropriate oversight, spanned a period of several years, and were trivially identifiable from the information publicly available or that Symantec shared.<\/p>\n<\/blockquote>\n Chrome\u2019s spat with Symantec stretches back over more than a year. In October 2015<\/a>, Google discovered that Symantec has misissued certificates for Google itself and for Opera Software.<\/p>\n Symantec investigated the issue and claimed that all of the misissued certificates had been issued as part of routine testing. \u201cOur investigation uncovered no evidence of malicious intent, nor harm to anyone,\u201d Symantec said<\/a> at the time.<\/p>\n Symantec pushed back on Google\u2019s current allegations Friday, saying that Google had singled out Symantec and had exaggerated the number of misissued certificates leading to the problem in the first place.<\/p>\n \u201cGoogle\u2019s statements about our issuance practices and the scope of our past mis-issuances are exaggerated and misleading. For example, Google\u2019s claim that we have mis-issued 30,000 SSL\/TLS certificates is not true. In the event Google is referring to, 127 certificates \u2014 not 30,000 \u2014 were identified as mis-issued, and they resulted in no consumer harm,\u201d Symantec wrote in a blog post<\/a>. \u201cWhile all major CAs have experienced SSL\/TLS certificate mis-issuance events, Google has singled out the Symantec Certificate Authority in its proposal even though the mis-issuance event identified in Google\u2019s blog post involved several CAs.\u201d<\/p>\n Google\u2019s Sleevi said in another post that Symantec partnered with other CAs \u2014 CrossCert (Korea Electronic Certificate Authority),\u00a0Certisign Certificatadora Digital,\u00a0Certsuperior S. de R. L. de C.V., and\u00a0Certisur S.A. \u2014 that did not follow proper verification procedures, which led to the misissuance of 30,000 certificates.<\/p>\n \u201cSymantec has acknowledged they were actively aware of this for at least one party, failed to disclose this to root programs, and did not sever the relationship with this party,\u201d he wrote<\/a>. \u201cAt least 30,000 certificates were issued by these parties, with no independent way to assess the compliance of these parties to the expected standards. Further, these certificates cannot be technically identified or distinguished from certificates where Symantec performed the validation role.\u201d<\/p>\n While Google and Symantec continue their fight \u2014 Symantec said it is \u201copen to discussing the matter with Google in an effort to resolve the situation\u201d \u2014 website owners that use Symantec to verify their HTTPS connections will need to start taking steps to ensure Chrome users can access their sites without getting hit with security warnings.<\/p>\n Symantec has severed ties with the four firms associated with the misissued certificates, so Chrome will trust new Symantec certificates going forward \u2014 site owners just need to\u00a0swap out their old certificates for new ones.<\/p>\n Here\u2019s the schedule, according to Sleevi:<\/p>\n To balance the compatibility risks versus the security risks, we propose a gradual distrust of all existing Symantec-issued certificates, requiring that they be replaced over time with new, fully revalidated certificates, compliant with the current Baseline Requirements. This will be accomplished by gradually decreasing the \u2018maximum age\u2019 of Symantec-issued certificates over a series of releases, distrusting certificates whose validity period (the difference of notBefore to notAfter) exceeds the specified maximum.<\/p>\n The proposed schedule is as follows:<\/p>\n Chrome 59 (Dev, Beta, Stable): 33 months validity (1023 days)<\/p>\n Chrome 60 (Dev, Beta, Stable): 27 months validity (837 days)<\/p>\n Chrome 61 (Dev, Beta, Stable): 21 months validity (651 days)<\/p>\n Chrome 62 (Dev, Beta, Stable): 15 months validity (465 days)<\/p>\n Chrome 63 (Dev, Beta): 9 months validity (279 days)<\/p>\n Chrome 63 (Stable): 15 months validity (465 days)<\/p>\n Chrome 64 (Dev, Beta, Stable): 9 months validity (279 days)<\/p>\n<\/blockquote>\n Symantec, for its part, seems hopeful that Google will back off and not require any changes at all. \u201cWe want to reassure our customers and all consumers that they can continue to trust Symantec SSL\/TLS certificates. Symantec will vigorously defend the safe and productive use of the Internet, including minimizing any potential disruption caused by the proposal in Google\u2019s blog post,\u201d the company said.<\/p>\n","protected":false},"excerpt":{"rendered":"\n
\n
![\"\"](\"https:\/\/tctechcrunch2011.files.wordpress.com\/2014\/08\/chrome1.png?w=680\")
Google, which has accused Symantec and its partners of misissuing tens of thousands of certificates for encrypted web connections,\u00a0quietly announced Thursday that it’s downgrading the level and length of trust Chrome will place in certificates issued by Symantec. Encrypted web connections — HTTPS connections like those on banking sites, login pages or news sites like this one… Read More<\/a><\/p>\n\n<\/img><\/a>
<\/img><\/a>
<\/img><\/a>
<\/img><\/a>
<\/img><\/a>
<\/img><\/a>\n<\/div>\n
<\/p>\n","protected":false},"author":5817,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[25],"tags":[59,66,26],"class_list":["post-336876","post","type-post","status-publish","format-standard","hentry","category-technology","tag-media","tag-techcrunch","tag-technology"],"_links":{"self":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/posts\/336876","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/users\/5817"}],"replies":[{"embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/comments?post=336876"}],"version-history":[{"count":0,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/posts\/336876\/revisions"}],"wp:attachment":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/media?parent=336876"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/categories?post=336876"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/tags?post=336876"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}