Menu
The end for 1024-bit SSL certificates is near, Mozilla kills a few more

The end for 1024-bit SSL certificates is near, Mozilla kills a few more

Website owners still using 1024-bit SSL certificates should replace them with 2048-bit ones

Website owners take notice: In weeks, Mozilla products including its popular Firefox browser will stop trusting an unknown number of SSL certificates that were issued using old root CA certificates with 1024-bit RSA keys.

The move is part of the organization's efforts that started in September to force certificate authorities (CAs) and their customers to stop using 1024-bit certificates, which are considered cryptographically unsafe because of advances in computing power.

"If you manage an SSL-enabled website, this change will not impact you if your certificates and the certificates above it have 2048-bit keys or more," the Mozilla security engineering team said Wednesday in a blog post. "If your SSL certificate has a 1024-bit key, or was issued by a certificate with a 1024-bit key, then you will need to get a new SSL certificate, and update the certificates in your Web server."

Owners of 2048-bit certificates that chain back to intermediate CA certificates with 1024-bit keys will also be impacted if they don't update the certificate chain on their Web servers to include a 2048-bit intermediate from their certificate authority.

Each certificate authority has one or more root certificates that it uses to sign SSL certificates with when issuing them to customers. Those CA certificates are included in operating systems, major browsers and other products according to well established agreements and are used to verify the authenticity of SSL certificates presented by websites.

In Firefox 36, which is currently in beta testing but is scheduled to be released on Feb. 24, Mozilla removed five 1024-bit CA certificates owned by Verizon and Symantec. The certificates flagged for removal are: GTE CyberTrust Global Root, Thawte Server CA, Thawte Premium Server CA, Class 3 Public Primary Certification Authority -- G2 and Equifax Secure eBusiness CA-1.

This means that Firefox 36 and later will no longer trust SSL certificates that chain back to one of those roots and will display an untrusted connection error when encountering such certificates online.

Mozilla already removed eight other 1024-bit CA certificates in September, in Firefox 32. Those belonged to Entrust, SECOM, GoDaddy, EMC/RSA, VeriSign (now Symantec) and NetLock.

The third and final phase of this process is also expected to happen during the first half of this year and will involve the removal of two more Equifax root certificates owned by Symantec. According to a note on the Mozilla bug tracker from earlier this week, one of those two Equifax root certificates is still "very widely used."


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags privacymozillasymanteconline safetyverizonpki

Brand Post

Featured

Slideshows

Reseller News Platinum Club celebrates leading partners in 2019

Reseller News Platinum Club celebrates leading partners in 2019

The leading players of the New Zealand channel came together to celebrate a year of achievement at the annual Reseller News Platinum Club lunch in Auckland. Following the Reseller News Innovation Awards, Platinum Club provides a platform to showcase the top performing partners and start-ups of the past 12 months.

Reseller News Platinum Club celebrates leading partners in 2019
Reseller News hosts alumnae breakfast for Women in ICT Awards

Reseller News hosts alumnae breakfast for Women in ICT Awards

Reseller News hosted its second annual alumnae breakfast for the Women in ICT Awards in New Zealand, designed to showcase the leading female leaders in the industry. Held at The Cordis in Auckland, attendees came together to hear inspiring keynotes and panel discussions, alongside high-level networking among peers. Photos by Gino Demeer.

Reseller News hosts alumnae breakfast for Women in ICT Awards
Reseller News Innovation Awards 2019: meet the winners

Reseller News Innovation Awards 2019: meet the winners

Reseller News honoured the standout players of the New Zealand channel in front of more than 480 technology leaders in Auckland on 23 October, recognising the achievements of top partners, emerging entrants and innovative start-ups.

Reseller News Innovation Awards 2019: meet the winners
Show Comments