News

According to the latest updates of the CA/B Forum rules, which is acting as the SSL industry regulator, SSL issuing certification authority (such as Symantec, GeoTrust, Thawte or RapidSSL) must be listed in the CAA DNS domain record.

Until recently, certifying authorities were able to delegate the domain/IP verification process to third-party companies. Gervase Markham (Mozilla), as well as Ryan Sleevi (Google) and Mike Reilly (Microsoft) decided to make a proposal to the CA / B Forum about forbidding such practice.

We still recall what consequences Symantec was threatened by representatives of leading browsers due to the erroneous issuance of SSL certificates. There were different sanctions offered, as the industry did not want to leave Symantec actions without attention. According to Symantec statements in the blog, they determined to overcome any obstacles. However, recently Symantec decided to change their strategy. Symantec posted in their online blog that the company decided to sell part of its business associated with SSL certificates to DigiCert.

WoSign and StartCom certifying authorities have been repeatedly violating SSL certificates issuing process in the past and now will be completely distrusted in the Chrome browser. This process is currently being implemented, and will be accomplished by the time of Chrome 61 release.

Chrome developers revealed a roadmap for gradual distrust in Symantec certificates after a large-scale discussion, caused by the fact that Symantec certificates were issued incorrectly.