Its become clear that the only way to improve security of certificate authorities is to follow through on threats. Symantec has been delinquent since 2012 in securing their processes and software. We have seen multiple instances of certificate falsely issued to domains (including Google’s domain). As the owner of Chrome browser, it has decided that Symantec is no longer fit to be considered a root authority for TLS (SSL) certificate.
Effective immediately, Chrome plans to stop recognizing the extended validation status of all certificates issued by Symantec-owned certificate authorities, Ryan Sleevi, a software engineer on the Google Chrome team, said Thursday in an online forum. Extended validation certificates are supposed to provide enhanced assurances of a site’s authenticity by showing the name of the validated domain name holder in the address bar. Under the move announced by Sleevi, Chrome will immediately stop displaying that information for a period of at least a year. In effect, the certificates will be downgraded to less-secure domain-validated certificates.
This is necessary. Politically this is a sound move. Taking down a major company that is US-based following removed of Chinese and Eastern European CA root certificates sends a message of fairness and balance. The repeat offenses by Symantec suggest that this it has systemic problems that it hasn’t been able to fix. Thats a top down problem, not a bottom up.
Given that Symantec is a major supplier to enteprises for a wide range of supposedly secure products, this means a lot of work. Symantec’s record and reputation on producing secure software is quite poor.
Google takes Symantec to the woodshed for mis-issuing 30,000 HTTPS certs [updated] | Ars Technica : https://arstechnica.com/security/2017/03/google-takes-symantec-to-the-woodshed-for-mis-issuing-30000-https-certs/
The post Google takes Symantec to the woodshed for mis-issuing 30,000 HTTPS certs [updated] | Ars Technica appeared first on EtherealMind.