{"id":2334,"date":"2018-07-30T18:25:37","date_gmt":"2018-07-31T01:25:37","guid":{"rendered":"https:\/\/blog.mozilla.org\/security\/?p=2334"},"modified":"2018-07-30T18:25:37","modified_gmt":"2018-07-31T01:25:37","slug":"update-on-the-distrust-of-symantec-tls-certificates","status":"publish","type":"post","link":"https:\/\/blog.mozilla.org\/security\/2018\/07\/30\/update-on-the-distrust-of-symantec-tls-certificates\/","title":{"rendered":"Update on the Distrust of Symantec TLS Certificates"},"content":{"rendered":"<p><a href=\"https:\/\/www.mozilla.org\/en-US\/firefox\/60.0\/releasenotes\/\">Firefox 60<\/a> (the current release) displays an \u201c<a href=\"https:\/\/support.mozilla.org\/en-US\/kb\/what-does-your-connection-is-not-secure-mean\">untrusted connection<\/a>\u201d error for any website using a TLS\/SSL certificate issued before June 1, 2016 that chains up to a Symantec root certificate. This is part of the <a href=\"https:\/\/groups.google.com\/a\/chromium.org\/forum\/#!msg\/blink-dev\/eUAKwjihhBs\/El1mH8S6AwAJ\">consensus proposal<\/a> for removing trust in Symantec TLS certificates that Mozilla adopted in 2017. This proposal was also adopted by the Google Chrome team, and more recently <a href=\"https:\/\/support.apple.com\/en-us\/HT208860\">Apple announced their plan<\/a> to distrust Symantec TLS certificates. As <a href=\"https:\/\/blog.mozilla.org\/security\/2017\/10\/31\/statement-digicerts-proposed-purchase-symantec\/\">previously stated<\/a>, DigiCert\u2019s acquisition of Symantec\u2019s Certification Authority has not changed these plans.<\/p>\n<p>In early March when we last <a href=\"https:\/\/blog.mozilla.org\/security\/2018\/03\/12\/distrust-symantec-tls-certificates\/\">blogged on this topic<\/a>, roughly 1% of websites were broken in Firefox 60 due to the change described above. Just before the release of Firefox 60 on May 9, 2018, less than 0.15% of websites were impacted &#8211; a major improvement in just a few months\u2019 time.<\/p>\n<p>The next phase of the consensus plan is to distrust any TLS certificate that chains up to a Symantec root, regardless of when it was issued (note that there is a small <a href=\"https:\/\/chromium.googlesource.com\/chromium\/src\/+\/master\/net\/data\/ssl\/symantec\">exception<\/a> for TLS certificates issued by a few intermediate certificates that are managed by certain companies, and this phase does not affect S\/MIME certificates). This <a href=\"https:\/\/bugzilla.mozilla.org\/show_bug.cgi?id=1460062\">change<\/a> is scheduled for Firefox 63, with the following planned <a href=\"https:\/\/wiki.mozilla.org\/Release_Management\/Calendar\">release dates<\/a>:<\/p>\n<ul>\n<li>Beta &#8211; September 5<\/li>\n<li>Release &#8211; October 23<\/li>\n<\/ul>\n<p>We have begun to assess the impact of the upcoming change to Firefox 63. We found that 3.5% of the <a href=\"http:\/\/s3-us-west-1.amazonaws.com\/umbrella-static\/index.html\">top 1 million websites<\/a> are still using Symantec certificates that will be distrusted in September and October (sooner in Firefox <a href=\"https:\/\/wiki.mozilla.org\/Nightly\">Nightly<\/a>)! This number represents a very significant impact to Firefox users, but it has declined by over 20% in the past two months, and as the Firefox 63 release approaches, we expect the same rapid pace of improvement that we observed with the Firefox 60 release.<\/p>\n<p>We strongly encourage website operators to replace any remaining Symantec TLS certificates immediately to avoid impacting their users as these certificates become distrusted in Firefox Nightly and Beta over the next few months. This upcoming change can already be tested in Firefox <a href=\"https:\/\/wiki.mozilla.org\/Nightly\">Nightly<\/a> by setting the <i>security.pki.distrust_ca_policy<\/i> preference to \u201c2\u201d via the <a href=\"https:\/\/support.mozilla.org\/en-US\/kb\/about-config-editor-firefox\">Configuration Editor<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Firefox 60 (the current release) displays an \u201cuntrusted connection\u201d error for any website using a TLS\/SSL certificate issued before June 1, 2016 that chains up to a Symantec root certificate. &hellip; <a class=\"go\" href=\"https:\/\/blog.mozilla.org\/security\/2018\/07\/30\/update-on-the-distrust-of-symantec-tls-certificates\/\">Read more<\/a><\/p>\n","protected":false},"author":1574,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[45538,69],"tags":[],"coauthors":[320076],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v22.5 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Update on the Distrust of Symantec TLS Certificates - Mozilla Security Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/blog.mozilla.org\/security\/2018\/07\/30\/update-on-the-distrust-of-symantec-tls-certificates\/\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Wayne Thayer\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/2018\/07\/30\/update-on-the-distrust-of-symantec-tls-certificates\/\",\"url\":\"https:\/\/blog.mozilla.org\/security\/2018\/07\/30\/update-on-the-distrust-of-symantec-tls-certificates\/\",\"name\":\"Update on the Distrust of Symantec TLS Certificates - Mozilla Security Blog\",\"isPartOf\":{\"@id\":\"https:\/\/blog.mozilla.org\/security\/#website\"},\"datePublished\":\"2018-07-31T01:25:37+00:00\",\"dateModified\":\"2018-07-31T01:25:37+00:00\",\"author\":{\"@id\":\"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/e9d30f6a04fd425b92ce414efb490f7a\"},\"breadcrumb\":{\"@id\":\"https:\/\/blog.mozilla.org\/security\/2018\/07\/30\/update-on-the-distrust-of-symantec-tls-certificates\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/blog.mozilla.org\/security\/2018\/07\/30\/update-on-the-distrust-of-symantec-tls-certificates\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/2018\/07\/30\/update-on-the-distrust-of-symantec-tls-certificates\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/blog.mozilla.org\/security\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Update on the Distrust of Symantec TLS Certificates\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/#website\",\"url\":\"https:\/\/blog.mozilla.org\/security\/\",\"name\":\"Mozilla Security Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/blog.mozilla.org\/security\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/e9d30f6a04fd425b92ce414efb490f7a\",\"name\":\"Wayne Thayer\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/image\/9d66cb7b8ff76e006a6f0af6fa7d949a\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/2bd1ca829153b238eca5f4da201857f9?s=96&d=identicon&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/2bd1ca829153b238eca5f4da201857f9?s=96&d=identicon&r=g\",\"caption\":\"Wayne Thayer\"},\"sameAs\":[\"https:\/\/x.com\/wthayer\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Update on the Distrust of Symantec TLS Certificates - Mozilla Security Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/blog.mozilla.org\/security\/2018\/07\/30\/update-on-the-distrust-of-symantec-tls-certificates\/","twitter_misc":{"Written by":"Wayne Thayer","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/blog.mozilla.org\/security\/2018\/07\/30\/update-on-the-distrust-of-symantec-tls-certificates\/","url":"https:\/\/blog.mozilla.org\/security\/2018\/07\/30\/update-on-the-distrust-of-symantec-tls-certificates\/","name":"Update on the Distrust of Symantec TLS Certificates - Mozilla Security Blog","isPartOf":{"@id":"https:\/\/blog.mozilla.org\/security\/#website"},"datePublished":"2018-07-31T01:25:37+00:00","dateModified":"2018-07-31T01:25:37+00:00","author":{"@id":"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/e9d30f6a04fd425b92ce414efb490f7a"},"breadcrumb":{"@id":"https:\/\/blog.mozilla.org\/security\/2018\/07\/30\/update-on-the-distrust-of-symantec-tls-certificates\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blog.mozilla.org\/security\/2018\/07\/30\/update-on-the-distrust-of-symantec-tls-certificates\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/blog.mozilla.org\/security\/2018\/07\/30\/update-on-the-distrust-of-symantec-tls-certificates\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/blog.mozilla.org\/security\/"},{"@type":"ListItem","position":2,"name":"Update on the Distrust of Symantec TLS Certificates"}]},{"@type":"WebSite","@id":"https:\/\/blog.mozilla.org\/security\/#website","url":"https:\/\/blog.mozilla.org\/security\/","name":"Mozilla Security Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/blog.mozilla.org\/security\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/e9d30f6a04fd425b92ce414efb490f7a","name":"Wayne Thayer","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/image\/9d66cb7b8ff76e006a6f0af6fa7d949a","url":"https:\/\/secure.gravatar.com\/avatar\/2bd1ca829153b238eca5f4da201857f9?s=96&d=identicon&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/2bd1ca829153b238eca5f4da201857f9?s=96&d=identicon&r=g","caption":"Wayne Thayer"},"sameAs":["https:\/\/x.com\/wthayer"]}]}},"_links":{"self":[{"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/posts\/2334"}],"collection":[{"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/users\/1574"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/comments?post=2334"}],"version-history":[{"count":0,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/posts\/2334\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/media?parent=2334"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/categories?post=2334"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/tags?post=2334"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/coauthors?post=2334"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}