Сертификаты StartCom снова не нравятся google?

Question

[Алексей]

Интересуют проблемы с конкретным сайтом для начала.


Возможно проблемы с издателем сертификата:


Сайт не открывается в Cromium\Chrome Canary версий 61.0.3132 или 61.0.3133.
В Chrome версии 59.0.3071.104, 60.0.3107.4, 61.0.3126.0 и в Firefox 54, 55 и IE 11/ Edge сайт открывается.

Answer 1

[sim3x]

Если не страдать конспирологиями

https://security.googleblog.com/2016/10/distrustin...

Background
On August 17, 2016, Google was notified by GitHub's security team that WoSign had issued a certificate for one of GitHub's domains without their authorization. This prompted an investigation, conducted in public as a collaboration with Mozilla and the security community, which found a number of other cases of WoSign misissuance.
The investigation concluded that WoSign knowingly and intentionally misissued certificates in order to circumvent browser restrictions and CA requirements. Further, it determined that StartCom, another CA, had been purchased by WoSign, and had replaced infrastructure, staff, policies, and issuance systems with WoSign's. When presented with this evidence, WoSign and StartCom management actively attempted to mislead the browser community about the acquisition and the relationship of these two companies. For both CAs, we have concluded there is a pattern of issues and incidents that indicate an approach to security that is not in concordance with the responsibilities of a publicly trusted CA.

https://groups.google.com/forum/#!topic/mozilla.de...

Comments

[Алексей]

Получается спустя полгода google решились признать абсолютно все сертификаты StartCom невалидными?

Сертификаты сайтов от 26 февраля 2016 и 23 марта 2016, что раньше чем "October 21, 2016".

[sim3x]

Алексей:

Получается, что гугл заранее сказал

Due to a number of technical limitations and concerns, Google Chrome is unable to trust all pre-existing certificates while ensuring our users are sufficiently protected from further misissuance. As a result of these changes, customers of WoSign and StartCom may find their certificates no longer work in Chrome 56.
In subsequent Chrome releases, these exceptions will be reduced and ultimately removed, culminating in the full distrust of these CAs.

[Алексей]

Всё ясно, значит настало время.
Ждем переноса этого счастья в релизную ветку и прощаемся.

Answer 2

[Алексей]

sim3x:

Due to a number of technical limitations and concerns, Google Chrome is unable to trust all pre-existing certificates while ensuring our users are sufficiently protected from further misissuance. As a result of these changes, customers of WoSign and StartCom may find their certificates no longer work in Chrome 56.
In subsequent Chrome releases, these exceptions will be reduced and ultimately removed, culminating in the full distrust of these CAs.