Websites Replace Digital Certificates as Browsers Set Deadlines to Revoke Trust

The company that bought one of the largest certificate authorities (CAs) said it has nearly finished replacing the digital certificates most commonly used by popular websites as major browsers prepare to phase them out in upcoming releases.

DigiCert Inc. said it has been sending mass email messages, calling customers and running webinars to make sure website owners are aware that Google and Mozilla will no longer trust Symantec-backed digital certificates when they release Chrome 66 next month and Mozilla Firefox 60 in May. DigiCert, which bought the CA business from Symantec last fall, noted that more than 99 percent of the top 1 million websites have taken appropriate action.

Purging Outdated Digital Certificates

According to SecurityWeek, the browser-makers established deadlines to revoke trust in digital certificates in response to a series of errors in the way they were issued and managed. DigiCert set up a portal for customers to check their domain name to determine whether they need new or replacement certificates. Companies that used RapidSSL, GeoTrust and Thawte can also obtain replacements through DigiCert.

For all its progress, Enterprise Times raised questions about how DigiCert will manage to win over the remaining customers who had obtained digital certificates through Symantec and other providers. This includes not only the top websites, but also many small and medium-sized businesses (SMBs) that could be affected by the browsers’ deadlines.

A Bumpy Transition

The transition of the CA business from Symantec to DigiCert has not been entirely smooth. Earlier this month, CRN Australia reported that the website of Trustico, a Symantec reseller, temporarily went offline after DigiCert claimed it had emailed the private keys of more than 20,000 digital certificates, which were later revoked. According to TechTarget, DigiCert claimed that 23,000 certificates were compromised, although the number of individual organizations affected by the incident has not been publicly reported.

Recently, DigiCert set up a new reseller program to make it easier to obtain and deploy digital certificates within the enterprise. The program aims to help the CA’s partners take advantage of the opportunity offered by Secure Sockets Layer (SSL), public key infrastructure and Internet of Things (IoT) security.

Shane Schick

Writer & Editor

NIST’s role in the global tech race against AI

4 min read - Last year, the United States Secretary of Commerce announced that the National Institute of Standards and Technology (NIST) has been put in charge of launching a new public working group on artificial intelligence (AI) that will build on the success of the NIST AI Risk Management Framework to address this rapidly advancing technology.However, recent budget cuts at NIST, along with a lack of strategy implementation, have called into question the agency’s ability to lead this critical effort. Ultimately, the success…

Researchers develop malicious AI ‘worm’ targeting generative AI systems

2 min read - Researchers have created a new, never-seen-before kind of malware they call the "Morris II" worm, which uses popular AI services to spread itself, infect new systems and steal data. The name references the original Morris computer worm that wreaked havoc on the internet in 1988.The worm demonstrates the potential dangers of AI security threats and creates a new urgency around securing AI models.New worm utilizes adversarial self-replicating promptThe researchers from Cornell Tech, the Israel Institute of Technology and Intuit, used what’s…

Passwords, passkeys and familiarity bias

5 min read - As passkey (passwordless authentication) adoption proceeds, misconceptions abound. There appears to be a widespread impression that passkeys may be more convenient and less secure than passwords. The reality is that they are both more secure and more convenient — possibly a first in cybersecurity.Most of us could be forgiven for not realizing passwordless authentication is more secure than passwords. Thinking back to the first couple of use cases I was exposed to — a phone operating system (OS) and a…

Security Intelligence

{{title}}

{{title}}

{{title}}

Topics

Purging Outdated Digital Certificates

A Bumpy Transition

More from

NIST’s role in the global tech race against AI

Researchers develop malicious AI ‘worm’ targeting generative AI systems

Passwords, passkeys and familiarity bias

Topic updates