TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Distrust of Symantec TLS Certificates

307 pointsby asymmetricover 6 years ago

21 comments

korethrover 6 years ago
There&#x27;s been downvoted comments below that, to me, seem to complain of Mozilla unfairly blindsiding domain owners.<p>I disagree, based on my own personal experience. This has been coming for a while, with plenty of forewarning.<p>My employer uses certificates from one of Symantec&#x27;s brands. Last year, we began to get notices that Chrome et. al. would be distrusting the certificates issued from the old Symantec root this year, and that we would need to claim our free replacements issued from the new trust root that is replacing Symantec&#x27;s. And it&#x27;s not been just one notice, we&#x27;ve been getting them regularly. And in addition to the automatic form emails, the sales rep assigned our account personally reached out to us to make sure we were getting this taken care of. We are not a large company, either; we have less than 100 employees. DigiCert is taking this transition seriously.<p>So IMO, if someone gets blindsided by their website breaking because of the Symantec root distrust, then they have only laziness and&#x2F;or incompetence to blame, whether it&#x27;s their own, or that of their website operator. Those who&#x27;s job it is to make sure that doesn&#x27;t happen have been warning about it for nearly a year now.
评论 #17920737 未加载
评论 #17922405 未加载
评论 #17920582 未加载
评论 #17920606 未加载
评论 #17924250 未加载
评论 #17921960 未加载
评论 #17924432 未加载
评论 #17920572 未加载
lbrinerover 6 years ago
Wow, I didn&#x27;t realise how many non-conformances there were with Symantec. It certainly looks like they had enough chances to get their houses in order and didn&#x27;t!<p>I wonder what the root problem was? They didn&#x27;t care, they didn&#x27;t think anyone would do anything or they are just a large sloppy corporate who can&#x27;t run a group properly?
评论 #17920135 未加载
评论 #17920841 未加载
评论 #17919422 未加载
评论 #17919909 未加载
AndrewDuckerover 6 years ago
Chrome doing likewise: <a href="https:&#x2F;&#x2F;security.googleblog.com&#x2F;2018&#x2F;03&#x2F;distrust-of-symantec-pki-immediate.html" rel="nofollow">https:&#x2F;&#x2F;security.googleblog.com&#x2F;2018&#x2F;03&#x2F;distrust-of-symantec...</a>
评论 #17920093 未加载
评论 #17919805 未加载
mjleeover 6 years ago
You can enable this now in Firefox 62 (latest stable)<p>&gt; In advance of removing all trust for Symantec-issued certificates in Firefox 63, a preference was added that allows users to distrust certificates issued by Symantec. To use this preference, go to about:config in the address bar and set the preference &quot;security.pki.distrust_ca_policy&quot; to 2.
sam0x17over 6 years ago
It&#x27;s been obvious to me for quite a while that EV etc only really tells you &quot;this person paid $$$ to get a cert&quot; rather than anything about the site being trustworthy or being who it says it is. I wouldn&#x27;t bat an eye if 10 years from now major browsers distrusted everything but letsencrypt. Once the letsencrypt project comes out with a comparable solution for code signing, there is really no more reason for paid cert companies to exist. They don&#x27;t check shit and it&#x27;s super easy to get fraudulent certs so the value of what they provide is $0.
评论 #17923040 未加载
评论 #17922477 未加载
评论 #17925035 未加载
oasisbobover 6 years ago
It would be nice to have the date reflected in the title of this post (March 2018). It&#x27;s relevant and a nice reminder because the full-distrust is coming soon, but there isn&#x27;t anything new here AFAICT.
评论 #17920129 未加载
joshoover 6 years ago
This is huge as it affects GeoTrust, RapidSSL, Thawte, and VeriSign.<p>I was aware of the Symantec issue and checked my own certs and didn&#x27;t see their name, but skimming the article I noticed RapidSSL and thought I&#x27;d double check and sure enough my certs are about to become bogus.
natchover 6 years ago
When such an error (see article) is presented, it’s a teachable moment not only for the user surfing the site, but also for the owner of the site who is going to field questions about the error message from users.<p>It would be great if Mozilla would include some wording that instills alarm in site owners about how the site’s information, not just the user’s, is at risk.<p>For example, most non-malicious site owners probably would not want maliciously altered content served from or made to appear as though it came from their site. Yet most of them are, I suspect, unaware that this is a danger when their site does not use TLS.<p>It would be great to see Mozilla take this chance to highlight this danger so that the people most in a position to make changes would become aware of this additional good reason to do so.
评论 #17919366 未加载
acdover 6 years ago
The CA trust model is totally broken! We pay certificate of authority CA companies a lot of money for certificates that are not fully confirmed to be authentic.<p>Here is a better model. You normally register your company with the local government corporate registration authority. The local government knows who this company is, who the corporate registrars are.<p>One should use a digital ID card to apply to register a company. The founders sign the registration of the company with their personal digital ID. The company is then registered. To apply for a domain name for a company should be digitally signed. The registration government authority should handle certificate of authentic not foreign CA registrars.<p>All corporations should use Government CAs all other types of certificates can then be issued by Lets Encrypt having proper DNS validation in place should help there too.<p>All else is broken security by design.
评论 #17922897 未加载
SpikeDadover 6 years ago
Apple is also distrusting Symantec CAs which started in Aug 2018 - fully by Fall 2018<p><a href="https:&#x2F;&#x2F;support.apple.com&#x2F;en-us&#x2F;HT208860" rel="nofollow">https:&#x2F;&#x2F;support.apple.com&#x2F;en-us&#x2F;HT208860</a>
ghostbrainalphaover 6 years ago
It&#x27;s just insane that they haven&#x27;t been able fix this issue and get back into good standing with 6 months warning.
评论 #17919495 未加载
评论 #17919611 未加载
评论 #17921949 未加载
评论 #17919445 未加载
评论 #17919496 未加载
评论 #17921585 未加载
评论 #17919177 未加载
retlehsover 6 years ago
PayPal&#x27;s site is affected by this
评论 #17919826 未加载
评论 #17923006 未加载
cpetersoover 6 years ago
Firefox bug 1484006 has a list of some sites that are still using distrusted Symantec certs:<p><a href="https:&#x2F;&#x2F;bugzilla.mozilla.org&#x2F;show_bug.cgi?id=1484006" rel="nofollow">https:&#x2F;&#x2F;bugzilla.mozilla.org&#x2F;show_bug.cgi?id=1484006</a>
ibottyover 6 years ago
<a href="https:&#x2F;&#x2F;www.ssllabs.com&#x2F;ssltest&#x2F;analyze.html?d=www.paypal.com&amp;latest" rel="nofollow">https:&#x2F;&#x2F;www.ssllabs.com&#x2F;ssltest&#x2F;analyze.html?d=www.paypal.co...</a><p>I was getting frustrated because I could not visit Paypal (and Ebay) with Firefox nightly, because thy still use the old Symantec TLS certificates. I wonder whether there is _any_ major party that should be more concerned with their certificates than Paypal.
King-Aaronover 6 years ago
I&#x27;ve got a question about this, as I&#x27;ve been hurled into the admin of our certs, and honestly I probably shouldn&#x27;t be the one to do it, lol.<p>But, we run root certs from DigiCert with the rest of the chain provided by RapidSSL. However, I have not received any depreciation warnings via email or any notification in the console output on these sites.<p>Is there a utility available to &quot;check&quot; our sites, in the same way vendors provide utilities to verify your cert installations? Or should I assume that our stack is going to get caught up in this, and move to find alternative certs now?
评论 #17925063 未加载
foscoover 6 years ago
anyone know if Microsoft is following suit? I searched briefly and could not find any comments...
评论 #17919557 未加载
peterwwillisover 6 years ago
There&#x27;s two problems this exposes. One, it takes a very long time to dis-trust a root cert. This means some people&#x27;s connections could be exposed for a very long time.<p>Two, the method for update shown here is to upgrade your browser. Not everyone <i>can</i> upgrade their browser. Corporations often lock down browser updates, and take a very long time to upgrade. Sure, it&#x27;s fine for you to say &quot;that&#x27;s the corporation&#x27;s fault, too bad for them!&quot; but the users of those companies still have to suffer in the meanwhile - to say nothing of vendored smartphone OSes with slow updates...<p>The other problem with upgrading is legacy computers run very old browsers. I don&#x27;t know if you&#x27;ve tried to browse the web on an old computer with a new browser, but here&#x27;s a secret: <i>it doesn&#x27;t work</i>. New browsers have so many &quot;advancements&quot; that they bloat and crawl on older machines. So effectively, the means of being able to use the internet requires you to buy a new machine.<p>If operating systems immediately shipped patched CA lists, and browsers immediately used them, that would patch the legacy browsers. But it would not prevent sites from immediately breaking. So no matter what, either we wait forever to dis-trust certs, or we break sites.<p>Clearly we need an option C that will allow site owners to upgrade their keys immediately and without issue, and users to update their CA lists immediately and without issue. ACME is a good start, but it too has issues that need to be solved.<p>In addition, the whole idea of trusting hundreds of root certs to sign for every domain is just crazy. We need a method to sign certs only by the organization who actually has responsibility for ensuring the ownership of the domain: the registrar.<p>CAs are a great &quot;hack&quot; because they allow browsers to verify certs of sites without ever putting any onus on the registrar, but they also have a wacky &quot;trust&quot; model. Any of hundreds of organizations can verify who controls the IP space of a domain, one time, and issue a magical assurance of this, which is trusted until the assurance expires in several years. This can be overridden at any time, and it has nothing to do with who <i>actually controls the domain</i>, which is the registrar and the user who registered it. All the current system really verifies is who controlled the DNS at one time, which is merely pointed to by the registrar, and can be hacked independently of the registrar, meaning there are extra attack vectors.<p>Yes, lots of little extra &quot;hacks&quot; have been added as stop-gaps, like CAA, and Certificate Transparency, the now-defunct HPKP, and the future implementation of cert issuers verifying the DNS and host integrity from multiple ASNs. But these are just to keep the status quo limping on, and ignore the unnecessary risks the current design imposes. We need innovation and better design, not hacks.
评论 #17924332 未加载
yuhongover 6 years ago
My favorite story is when Mark Shuttleworth sold Thawte to VeriSign and used the money to start Canonical. This shows one of the problems of the current debt-based economy.
评论 #17924531 未加载
frandroidover 6 years ago
Wow, talk about an obscure warning that tells nothing to the domain owner.
评论 #17919551 未加载
评论 #17919863 未加载
评论 #17919536 未加载
评论 #17919770 未加载
xmichael999over 6 years ago
All I can say is Firefox and Mozilla need to go away.
评论 #17921616 未加载
user5994461over 6 years ago
FYI: Your site has been unreachable since April if you use Symantec certificates.<p>Chrome announced the depreciation for October but they didn&#x27;t stick to their own roadmap and blacklisted Symantec since April instead (Chrome 66 release). <a href="https:&#x2F;&#x2F;security.googleblog.com&#x2F;2018&#x2F;03&#x2F;distrust-of-symantec-pki-immediate.html" rel="nofollow">https:&#x2F;&#x2F;security.googleblog.com&#x2F;2018&#x2F;03&#x2F;distrust-of-symantec...</a>
评论 #17920681 未加载
评论 #17920364 未加载
评论 #17920601 未加载