The popular internet browsers Google Chrome and Mozilla Firefox have recently announced their plans to distrust any SSL cer­tifi­cates issued by the company Symantec before December 1st 2017. An SSL cer­tifi­cate is an important aspect of a website that handles sensitive, personal in­for­ma­tion. Symantec’s Web Security and other PKI solutions have been taken over by the company DigiCert – this ac­qui­si­tion will result in DigiCert updating and mod­ern­iz­ing several aspects of the Symantec model. However, in the meantime, Chrome and Mozilla have decided to remove trust in Symantec SSL cer­tifi­cates until these updates are completed.

Be secure. Buy an SSL cer­tifi­cate.
  • Secures data transfers
  • Avoids browser warnings
  • Improves your Google ranking

Why are these SSL cer­tifi­cates being targeted?

Chrome and Mozilla’s decision to distrust SSL cer­tifi­cates results from a small number of dis­crep­an­cies in SSL cer­tifi­cates issued by them between 2015 and now. The main criticism was about Symantec’s ability to ensure a proper au­then­ti­ca­tion process for SSL cer­tifi­cates. Debates between Symantec and the browser community have spread over several months and have concluded with two main action points laid down by Google Chrome and later confirmed by Mozilla:

  1. Symantec must partner up with another Cer­tifi­cate Authority to run the SSL au­then­ti­ca­tion and issuance processes from a new in­fra­struc­ture.

  2. All SSL cer­tifi­cates issued from prior Symantec roots will be dis­trust­ed and need to be replaced without extra cost following phased timeline.

Shortly after this decision, Symantec sold their SSL business to Digicert and started issuing fully compliant SSLl cer­tifi­cates from their new CA in­fra­struc­ture on December 1st 2017.

While Chrome and Mozilla may be acting in the interest of their customers safety, there are a number of browsers such as Internet Explorer, Safar and Opera who are choosing not to display warning messages to visitors, as they do not believe the threat to be as serious as Chrome and Mozilla claim. Re­gard­less of severity of the security risk, plenty of website operators may have their website affected by this campaign of distrust.

When will SSL cer­tifi­cates be affected?

Chrome will begin issuing security warnings on the April 16th, 2018 to Chrome 66 (and later) users when they try to access a Symantec SSL-encrypted website. This warning will appear on all Symantec SSL cer­tifi­cates issued before the June 1st, 2016. From October 2018, Chrome 70 (and above) users will also receive the message on all sites that contain Symantec SSL cer­tifi­cates issued before December 1st, 2017. The warning message simply states that the data exchange may be unsafe. Visitors can accept the warning and continue on to the website unimpeded: the website’s func­tion­al­i­ty will remain un­af­fect­ed. There is no risk to any data on your website being com­pro­mised.

Image: Key replacement dates as outlined by Google.
Google Chrome have announced a timeline for when SSL cer­tifi­cates need to be renewed.

How do I know if my cer­tifi­cate is affected?

In order to work out whether or not your website’s SSL cer­tifi­cates will be affected by this change, you will need to check the validity of the cer­tifi­cate. There are a number of online tools that can help you assert the validity of your SSL cer­tifi­cates – simple research, select and download your program to check their cer­tifi­cate validity. Al­ter­na­tive­ly, checking the validity through your own browser is quite straight­for­ward. Here, we will show you how to check whether your SSL cer­tifi­cates are in date or not on Google Chrome and Mozilla Firefox.

Google Chrome

To check the status of your SSL cer­tifi­cate on Chrome, select the icon next to the URL. This may be a green lock (con­nec­tion secure), a yellow ex­cla­ma­tion mark (no cer­tifi­cate provided), a blank page icon (this website does not need prior au­then­ti­ca­tion), a lock icon with a yellow triangle (cer­tifi­cate provided, but security standard is low) or a red padlock (site has cer­tifi­cate issues).  Click on the icon present and a window will pop up with an option to view the cer­tifi­cate:

Image: Checking the validity of your certificate on Chrome.]
Checking the validity of your cer­tifi­cate on Google Chrome is easy.

Go to the “Details” tab in the second popup window and you will be able to find the validity period dates for the website’s cer­tifi­cate.

Mozilla Firefox

The process for checking the validity of an SSL cer­tifi­cate on Mozilla Firefox is more or less the same as checking on Chrome. Next to the URL should be a security icon – either a green padlock (secure), gray padlock with a yellow ex­cla­ma­tion triangle (con­nec­tion may not be secure) or a gray packlock with a red line through it (con­nec­tion not secure). Clicking on the security icon will bring up a small pop up window:

Image: Checking the validity of your certificate on Firefox.Asha SreenivasShut­ter­stock
Checking the validity of your cer­tifi­cate on Mozilla Firefox is almost identical.

Simply click on the arrow next to the website con­nec­tion in­for­ma­tion and another window will pop open. In the General tab of the pop up window, the Period of Validity will be on display at the bottom.

Re­place­ment Timeline & Actions Required

The timeline consists of two phases which match Google Chrome 66 & 70 version releases:

Image: Replacement dates timeline.
Overview of the re­place­ment timeline for SSL cer­tifi­cates.

Phase I –Cer­tifi­cates issued before June 1st 2016 will be dis­trust­ed by Chrome 66. You will need to renew SSL cer­tifi­cates issued before this date on before March 15th 2018.

Phase II – If your SSL cer­tifi­cate was issued after December 1st, 2017 then there is no need to reissue it. Cer­tifi­cates issued before December 1st 2017 will be dis­trust­ed by Chrome 70. Any SSL cer­tifi­cates issued before this date will need to be replaced by September 13th 2018. With Chrome 66 you may already notice a warning in Chrome Developer Tools:

Image: Chrome Developer Tools Warning.
Chrome 66 users may already be ex­pe­ri­enc­ing this warning message.

If the SSL cer­tifi­cate is not replaced before Chrome 70 is released, then your customers will no longer be able to access your site:

Image: Chrome 70 user warning.
Chrome 70 users may already be ex­pe­ri­enc­ing this warning.

Taking Action

All affected SSL cer­tifi­cates need to be replaced through a Reissue operation. This provides a new cer­tifi­cate for the same domain, with the same ex­pi­ra­tion date as the one replaced.

Note

If your cer­tifi­cate expires before Sept 13th 2018 (Chrome 70 beta), there’s no need to take any action.

Symantec/DigiCert are offering affected customers a new SSL cer­tifi­cate free of charge. You will need to create a CSR (Cer­tifi­cate Signing Request) for each of the cer­tifi­cates you wish to replace/have reissued, which is a standard procedure for sending DigiCert your public key, in­for­ma­tion about your company and your domain name. Submit your request, and once DigiCert have reval­i­dat­ed your domains and or­ga­ni­za­tions, you will receive the new cer­tifi­cate which you can install.

Go to Main Menu