4

Recently Google Chrome started issuing a warning on the console which says:

The SSL certificate used to load resources from https://www.example.com will be distrusted in M70. Once distrusted, users will be prevented from loading these resources.

Where the URL is the address of a third-party used to display advertising and this includes big names such as Amazon.

It sounds like that people will no longer see these ads at all after M70 which is obviously bad for sites that rely on those advertising platforms. So, first of all:

  • When is M70?
  • What will happen exactly at that time?
  • Is there something webmasters must do or should we expect third-parties to solve it?
Improve this question
3

2 Answers 2

Reset to default
3

Quick Summary

  • March 15th 2018: Chrome 66 is released as beta and it will stop trusting Symantec-issued certificates issued prior to June 1, 2016.
  • April 17th 2018: Chrome 66 will change status from beta to stable release.
  • September 13th 2018: Chrome 70 is released as beta, which will remove trust in ALL old Symantec-rooted Infrastructure.
  • Chrome 70 will change status from beta to stable release.

The Google Chrome team advise site operators to reissue their CERTS as from now 1st December but it also states that you may need to do it again when version 70 is released.

Google is also limiting the CA root from Symantec to 13 months limit, so I would recommend that you choose a new vendor.

References Below

I recommend that you read through the page linked below, its long but hopefully will inform you in more ways than I have done so.

SOURCE

Chrome 66 released to beta, which will remove trust in Symantec-issued certificates with a not-before date prior to June 1, 2016. As of this date Site Operators must be using either a Symantec-issued TLS server certificate issued on or after June 1, 2016 or a currently valid certificate issued from any other trusted CA as of Chrome 66.

Site Operators that obtained a certificate from Symantec’s old infrastructure after June 1, 2016 are unaffected by Chrome 66 but will need to obtain a new certificate by the Chrome 70 dates described below.

Chrome 70 released to Beta, which will remove trust in the old Symantec-rooted Infrastructure. This will not affect any certificate chaining to the new Managed Partner Infrastructure, which Symantec has said will be operational by December 1, 2017.

Only TLS server certificates issued by Symantec’s old infrastructure will be affected by this distrust regardless of issuance date. ~October 23, 2018 Chrome 70 released to Stable.

Improve this answer
4
  • How do I choose another vendor in this case? It's not like any of the sites being warned against are mine. Is there something that I can do or will Amazon (for example) have to make the change at some point?
    – Itai
    Commented Dec 21, 2017 at 22:29
  • Err? if you have no control over these sites then its not really a web mastering question, everything I have wrote about is aimed at web masters, not for end users. End users can agree to the warning that the SSL is not trusted or leave.
    – Simon Hayter
    Commented Dec 21, 2017 at 23:01
  • The warning appears on my site but the URL it refers too is not mine obviously since I don't own Amazon. Nevertheless, it seems to be worded to say that visitors of my site will see errors (or other glitch) when Chrome starts not trusting the certificates for Amazon (and several other providers of ads used on my site). So the question is whether there is something I must do or will Amazon and company have to sort it out by the deadline?
    – Itai
    Commented Dec 21, 2017 at 23:55
  • 1
    If the warning is appearing because of third party calls that your site is making you will have to rely on those third parties to get new SSL certificates. If you have a business relationship with them with a communications channel you could give them a heads up.
    – Stephen Ostermiller ♦
    Commented Dec 22, 2017 at 0:43
1

Webmaster needs to update their certificate and ask the third party certificate to be updated.

e.g : You can ask your vendor to update their certificates, In case of Amazon you can raise a compliance question to AWS and ask them to update on this issue.

https://aws.amazon.com/contact-us/

Issue reference at Google Blog: https://security.googleblog.com/2017/09/chromes-plan-to-distrust-symantec.html

Information For Site Operators

Starting with Chrome 66, Chrome will remove trust in Symantec-issued certificates issued prior to June 1, 2016. Chrome 66 is currently scheduled to be released to Chrome Beta users on March 15, 2018 and to Chrome Stable users around April 17, 2018.

If you are a site operator with a certificate issued by a Symantec CA prior to June 1, 2016, then prior to the release of Chrome 66, you will need to replace the existing certificate with a new certificate from any Certificate Authority trusted by Chrome.

As the Symantec certificate for login.salesforce.com dated back to 03/03/2016, the current Chrome Canary (V66) not accepting it.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.