secure.2degreesbroadband.co.nz SSL cert

Forums › 2degrees (including Slingshot, Orcon, Flip, Stuff Fibre, MyRepublic, 2talk and Vocus) › secure.2degreesbroadband.co.nz SSL cert

dfnt

1553 posts

Uber Geek
+1 received by user: 1036

Trusted

Lifetime subscriber

#240977 4-Oct-2018 20:56

So the end is near for the distrust of Symantec, and its various subsidiary CA's, SSL certs via Chrome.

Just FYI, I'm running Chrome beta so on version70.0.3538.45 now, getting this when browsing to secure.2degreesbroadband.co.nz

Probably best to get onto this asap, as the stable release of 70 is just around the corner, more info here

@2degreesCare

cc @NickMack

1 | 2

752 posts

Ultimate Geek
+1 received by user: 215

#2101819 4-Oct-2018 21:30

If i browse to that site, it shows it as no error and a RapidSSL Cert from 19/05/2017

Sure its not something on your side?

hio77

'That VDSL Cat'
13036 posts

Uber Geek
+1 received by user: 3896

ID Verified

Trusted

Lizard Networks

Subscriber

#2101825 4-Oct-2018 21:39

seems to be a valid cert imo...

seeing this though,

#include <std_disclaimer>

Any comments made are personal opinion and do not reflect directly on the position my current or past employers may have.

richms

29099 posts

Uber Geek
+1 received by user: 10210

Trusted

Lifetime subscriber

#2101826 4-Oct-2018 21:41

Firefox gives me this:

Richard rich.ms

dfnt

1553 posts

Uber Geek
+1 received by user: 1036

Trusted

Lifetime subscriber

#2101829 4-Oct-2018 21:47

I'm assuming you're both using Chrome 70, and that you're both aware GeoTrust and RapidSSL were owned by Symantec before being purchased by Digicert. And that you're both aware of the Google/Symantec spat.

Copy/paste from the Google blog:

We previously announced plans to deprecate Chrome’s trust in the Symantec certificate authority (including Symantec-owned brands like Thawte, VeriSign, Equifax, GeoTrust, and RapidSSL)

Chrome 70 Starting in Chrome 70, all remaining Symantec SSL/TLS certificates will stop working, resulting in a certificate error like the one shown above. To check if your certificate will be affected, visit your site in Chrome today and open up DevTools. You’ll see a message in the console telling you if you need to replace your certificate.

hio77

'That VDSL Cat'
13036 posts

Uber Geek
+1 received by user: 3896

ID Verified

Trusted

Lizard Networks

Subscriber

#2101832 4-Oct-2018 21:50

dfnt:

I'm assuming you're both using Chrome 70, and that you're both aware GeoTrust and RapidSSL were owned by Symantec before being purchased by Digicert.

Right, that explains it...

#include <std_disclaimer>

Any comments made are personal opinion and do not reflect directly on the position my current or past employers may have.

dfnt

1553 posts

Uber Geek
+1 received by user: 1036

Trusted

Lifetime subscriber

#2101835 4-Oct-2018 21:52

Chrome 70 stable isn't out till mid October, that's when the masses will start seeing the Symantec cert error on sites that haven't migrated to non Symantec issued certs

Quic Broadband

Move to New Zealand's best fibre broadband service (affiliate link). Free setup code: R587125ERQ6VE. Note that to use Quic Broadband you must be comfortable with configuring your own router.

skewt

752 posts

Ultimate Geek
+1 received by user: 215

#2101836 4-Oct-2018 21:52

Ahh, I had saw the bit about certs before 2016 being blocked but didn't realize they were going to block ALL certs from those providers

dfnt

1553 posts

Uber Geek
+1 received by user: 1036

Trusted

Lifetime subscriber

#2101837 4-Oct-2018 21:57

skewt:

Ahh, I had saw the bit about certs before 2016 being blocked but didn't realize they were going to block ALL certs from those providers

Yeah that was for Chrome 66, the final nail in the coffin will be Chrome 70 distrusting all certs that were issued by the various Symantec brands.

I believe all new certs under those brands are issued by Digicert now, e.g.:

michaelmurfy

meow
13580 posts

Uber Geek
+1 received by user: 10910

Moderator

ID Verified

Trusted

Lifetime subscriber

#2101841 4-Oct-2018 22:17

@dfnt As somebody who has had to replace a tonne of Symantec certificates over the last few months I can confirm you're correct here. The certs have to be redone with the new Digicert signer.

Michael Murphy | https://murfy.nz
Referral Links: Quic Broadband (use R122101E7CV7Q for free setup)

Are you happy with what you get from Geekzone? Please consider supporting us by subscribing.
Opinions are my own and not the views of my employer.

dfnt

1553 posts

Uber Geek
+1 received by user: 1036

Trusted

Lifetime subscriber

#2101857 4-Oct-2018 22:53

michaelmurfy:

@dfnt As somebody who has had to replace a tonne of Symantec certificates over the last few months I can confirm you're correct here. The certs have to be redone with the new Digicert signer.

Working in banking I imagine there were a lot of certs to replace -_-

freitasm

BDFL - Memuneh
80652 posts

Uber Geek
+1 received by user: 41045

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#2101868 4-Oct-2018 23:06

I can see so many sites going "Oh oh" when Chrome 70 comes out...

Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

Samsung

Shop now on Samsung phones, tablets, TVs and more (affiliate link).

dfnt

1553 posts

Uber Geek
+1 received by user: 1036

Trusted

Lifetime subscriber

#2101871 4-Oct-2018 23:07

freitasm:

I can see so many sites going "Oh oh" when Chrome 70 comes out...

Yeah, it's quite amusing/sad how many are still using Symantec/and their brands SSL certs

Lias

5655 posts

Uber Geek
+1 received by user: 3978

ID Verified

Trusted

Lifetime subscriber

#2101872 4-Oct-2018 23:10

michaelmurfy:

The certs have to be redone with the new Digicert signer.

Or better yet with free Let's Encrypt, Comodo or AWS ACM certificates.. It's high time people stopped paying money for SSL certs.

I'm a geek, a gamer, a dad, a Quic user, and an IT Professional. I have a full rack home lab, size 15 feet, an epic beard and Asperger's. I'm a bit of a Cypherpunk, who believes information wants to be free and the Net interprets censorship as damage and routes around it. If you use my Quic signup you can also use the code R570394EKGIZ8 for free setup. Opinions are my own and not the views of my employer.

michaelmurfy

meow
13580 posts

Uber Geek
+1 received by user: 10910

Moderator

ID Verified

Trusted

Lifetime subscriber

#2101873 4-Oct-2018 23:13

freitasm:

I can see so many sites going "Oh oh" when Chrome 70 comes out...

A month ago I was stressing a bit when one of our major sites didn't have a replacement certificate. I was going around with Google Chrome Canary doing verification when I noticed it, had to wait for the cert guys to generate a new cert and load it on the servers.

That was a month ago... Glad all the certs I am responsible for are now replaced ahead of schedule. But yes, I still come across quite a few sites with Symantec certs.

dfnt

1553 posts

Uber Geek
+1 received by user: 1036

Trusted

Lifetime subscriber

#2101874 4-Oct-2018 23:16

Lias:

michaelmurfy:

The certs have to be redone with the new Digicert signer.

Or better yet with free Let's Encrypt, Comodo or AWS ACM certificates.. It's high time people stopped paying money for SSL certs.

I'm even using Let's Encrypt (wildcard cert) for all my internal devices, like EdgeRouter, Synology NAS, pihole etc using nginx as a reverse proxy to them. That way I don't have to deal with self signed cert warnings when accessing them, and I just have a singular device that the cert resides on.

So easy when using the Cloudflare certbot plugin, so you don't have to expose your internal services for validation

1 | 2