Menu
The end for 1024-bit SSL certificates is near, Mozilla kills a few more

The end for 1024-bit SSL certificates is near, Mozilla kills a few more

Website owners still using 1024-bit SSL certificates should replace them with 2048-bit ones

Website owners take notice: In weeks, Mozilla products including its popular Firefox browser will stop trusting an unknown number of SSL certificates that were issued using old root CA certificates with 1024-bit RSA keys.

The move is part of the organization's efforts that started in September to force certificate authorities (CAs) and their customers to stop using 1024-bit certificates, which are considered cryptographically unsafe because of advances in computing power.

"If you manage an SSL-enabled website, this change will not impact you if your certificates and the certificates above it have 2048-bit keys or more," the Mozilla security engineering team said Wednesday in a blog post. "If your SSL certificate has a 1024-bit key, or was issued by a certificate with a 1024-bit key, then you will need to get a new SSL certificate, and update the certificates in your Web server."

Owners of 2048-bit certificates that chain back to intermediate CA certificates with 1024-bit keys will also be impacted if they don't update the certificate chain on their Web servers to include a 2048-bit intermediate from their certificate authority.

Each certificate authority has one or more root certificates that it uses to sign SSL certificates with when issuing them to customers. Those CA certificates are included in operating systems, major browsers and other products according to well established agreements and are used to verify the authenticity of SSL certificates presented by websites.

In Firefox 36, which is currently in beta testing but is scheduled to be released on Feb. 24, Mozilla removed five 1024-bit CA certificates owned by Verizon and Symantec. The certificates flagged for removal are: GTE CyberTrust Global Root, Thawte Server CA, Thawte Premium Server CA, Class 3 Public Primary Certification Authority -- G2 and Equifax Secure eBusiness CA-1.

This means that Firefox 36 and later will no longer trust SSL certificates that chain back to one of those roots and will display an untrusted connection error when encountering such certificates online.

Mozilla already removed eight other 1024-bit CA certificates in September, in Firefox 32. Those belonged to Entrust, SECOM, GoDaddy, EMC/RSA, VeriSign (now Symantec) and NetLock.

The third and final phase of this process is also expected to happen during the first half of this year and will involve the removal of two more Equifax root certificates owned by Symantec. According to a note on the Mozilla bug tracker from earlier this week, one of those two Equifax root certificates is still "very widely used."

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Tags online safetysymantecsecurityverizonencryptionprivacymozillapki

Slideshows

Top 50 defining moments of the New Zealand channel in 2016

Top 50 defining moments of the New Zealand channel in 2016

Reseller News looks back on a tumultuous 12 months for the New Zealand channel, assessing the fallout from a year of sizeable industry change. Whether it be local or global mergers and acquisitions, distribution deals or job changes, the channel that started the year differs somewhat to the one set to finish it - Reseller News assesses the key moments that made 2016.​

Top 50 defining moments of the New Zealand channel in 2016
​Hewlett Packard Enterprise honours high achieving NZ channel

​Hewlett Packard Enterprise honours high achieving NZ channel

Hewlett Packard Enterprise honoured its top performing Kiwi partners at the second running of its HPE Partner Awards in New Zealand, held at a glitzy ceremony in Auckland. Recognising excellence across eight categories - from distributors to resellers - the tech giant celebrated its first year as a standalone company, following its official split from HP in 2015.

​Hewlett Packard Enterprise honours high achieving NZ channel
Nutanix treats channel partners to Christmas cruise

Nutanix treats channel partners to Christmas cruise

Nutanix recently took to the seas for a Christmas Cruise around Sydney Harbour with its Australia and New Zealand staff, customers and partners to celebrate a stellar year for the vendor. With the sun out, they were all smiles and mingled over drinks and food.

Nutanix treats channel partners to Christmas cruise
Show Comments