Windows 10: Microsoft and DigiCert to begin deprecating Symantec TLS certificates

Brink · Oct 5, 2018

Starting in September 2018, Microsoft began deprecating the SSL/TLS capability of Symantec root certificates due to compliance issues. Google, Mozilla, and Apple have also announced deprecation plans related to Symantec SSL/TLS certificates. Symantec cryptographic certificates are used in critical environments across multiple industries. In 2017, DigiCert acquired Symantec’s web security business that included their certificate authority business.

Since the compliance issues were identified, Microsoft has been engaged with Symantec and DigiCert to uphold industry-wide compliance expectations and maintain customer trust. DigiCert created the deprecation schedule below in partnership with Microsoft to maintain trust in the industry while minimizing impact to our mutual customers.

During certificate renewal, customers must now replace their current certificate with one signed by a non-Symantec root. Based on the schedule below, Microsoft Edge and Internet Explorer running on Windows 10/Windows Server 2016 will no longer trust certificates signed by the associated root certificate if issued after the TLS NotBefore Date. Any certificates issued prior to this date will continue to be trusted until the certificate’s natural expiration. Internet Explorer running on legacy Windows versions will not be impacted.

Customers with questions about their certificates or this deprecation schedule are encouraged to contact DigiCert by visiting SSL Certificate Support.

Name Thumbprint Planned TLS NotBefore Date Symantec Class 3 Public Primary Certification Authority-G6 26A16C235A2472229B23628025BC8097C88524A1 9/30/2018 thawte Primary Root CA-G2 AADBBC22238FC401A127BB38DDF41DDB089EF012 9/30/2018 GeoTrust Universal CA E621F3354379059A4B68309D8A2F74221587EC79 9/30/2018 Symantec Class 3 Public Primary Certification Authority-G4 58D52DB93301A4FD291A8C9645A08FEE7F529282 1/31/2019 VeriSign Class 3 Public Primary Certification Authority-G4 22D5D8DF8F0231D18DF79DB7CF8A2D64C93F6C3A 1/31/2019 GeoTrust Primary Certification Authority-G2 8D1784D537F3037DEC70FE578B519A99E610D7B0 4/30/2019 VeriSign Universal Root Certification Authority 3679CA35668772304D30A5FB873B0FA77BB70D54 4/30/2019 thawte Primary Root CA-G3 F18B538D1BE903B6A6F056435B171589CAF36BF2 4/30/2019 GeoTrust Primary Certification Authority-G3 039EEDB80BE7A03C6953893B20D2D9323A4C2AFD 4/30/2019 GeoTrust 323C118E1BF7B8B65254E2E2100DD6029037F096 4/30/2019 thawte 91C6D6EE3E8AC86384E548C299295C756C817B81 4/30/2019 VeriSign 4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5 4/30/2019 GeoTrust Global CA DE28F4A4FFE5B92FA3C503D1A349A7F9962A8212 4/30/2019 VeriSign 132D0D45534B6997CDB2D5C339E25576609B5CC6 4/30/2019
Click to expand...

Source: Microsoft partners with DigiCert to begin deprecating Symantec TLS certificates - Microsoft Secure

:)

curatia · Oct 8, 2018

Microsoft Edge TLS Security

After trying everything (not a lot of steps) listed in the Microsoft Edge support site, I did a wider search and found this very simple youtube video that fixed it immediately:

For those who prefer not to click links the steps are simple:

1. Click in the Cortana search bar next to the Win 10 Start button

2. Type internet options

3. Select internet options (control panel) from the list

4. Click on the advanced tab

5. Scroll down to the security section

6. Make sure the following are all clicked:
Use SSL 3.0
Use TLS 1.0
Use TLS 1.1
Use TLS 1.2

7. Click apply

8. Refresh the page that was giving the error and it should now connect.

Hope this helps, it was a 30 second fix after hours of pounding my head against the error with the Support site suggestions.

Brink · Oct 8, 2018

Deprecation of SHA-1 for SSL/TLS Certificates in Microsoft Edge & IE11

Microsoft Security Advisory 4010323

Deprecation of SHA-1 for SSL/TLS Certificates in Microsoft Edge and Internet Explorer 11
Published: May 9, 2017
Version: 1.0

Executive Summary

Beginning May 9, 2017, Microsoft released updates to Microsoft Edge and Internet Explorer 11 to block sites that are protected with a SHA-1 certificate from loading and to display an invalid certificate warning. This change will only impact SHA-1 certificates that chain to a root in the Microsoft Trusted Root Program where the end-entity certificate or the issuing intermediate uses SHA-1. Enterprise or self-signed SHA-1 certificates will not be impacted, although we recommend that all customers quickly migrate to SHA-2 based certificates. For more information, please see Windows Enforcement of SHA1 Certificates.

For more information see Microsoft Knowledge Base Article 4010323.

Advisory Details

Issue References
For more information about this issue, see the following references:

[table][tr][td]References[/td] [td]References[/td] [/tr] [tr][td]General Information[/td] [td]Windows Enforcement of SHA1 Certificates[/td] [/tr] [tr][td][/td] [td]SHA-1 deprecation countdown[/td] [/tr] [tr][td]Technical Requirements[/td] [td]Protecting Against Weak Cryptographic Algorithms[/td] [/tr] [/table]

Affected Software

This advisory applies to the following operating systems:

[table][tr][td]Windows 7[/td] [/tr] [tr][td]Windows 7 for 32-bit Systems Service Pack 1[/td] [/tr] [tr][td]Windows 7 for x64-based Systems Service Pack 1[/td] [/tr] [tr][td]Windows Server 2008 R2[/td] [/tr] [tr][td]Windows Server 2008 R2 for x64-based Systems Service Pack 1[/td] [/tr] [tr][td]Windows Server 2008 R2 for Itanium-based Systems Service Pack 1[/td] [/tr] [tr][td]Windows 8.1[/td] [/tr] [tr][td]Windows 8.1 for 32-bit Systems[/td] [/tr] [tr][td]Windows 8.1 for x64-based Systems[/td] [/tr] [tr][td]Windows Server 2012 R2[/td] [/tr] [tr][td]Windows Server 2012 R2[/td] [/tr] [tr][td]Windows 10[/td] [/tr] [tr][td]Windows 10 for 32-bit Systems[/td] [/tr] [tr][td]Windows 10 for x64-based Systems[/td] [/tr] [tr][td]Windows 10 Version 1511 for 32-bit Systems[/td] [/tr] [tr][td]Windows 10 Version 1511 for x64-based Systems[/td] [/tr] [tr][td]Windows 10 Version 1607 for 32-bit Systems[/td] [/tr] [tr][td]Windows 10 Version 1607 for x64-based Systems[/td] [/tr] [tr][td]Windows Server 2016[/td] [/tr] [tr][td]Windows Server 2016 for x64-based Systems[/td] [/tr] [tr][td]Server Core installation option[/td] [/tr] [tr][td]Windows Server 2008 R2 for x64-based Systems (Server Core installation)[/td] [/tr] [tr][td]Windows Server 2012 R2 (Server Core installation)[/td] [/tr] [tr][td]Windows Server 2016 for x64-based Systems (Server Core installation)[/td] [/tr] [/table]

Advisory FAQ

What is the scope of the advisory?
This advisory aims to assist customers in assessing the risk of certain applications that use X.509 digital certificates that are signed using the SHA-1 hashing algorithm and to recommend that administrators and certificate authorities use SHA-2 in place of SHA-1 as an algorithm for signing digital certificates.

Is this a security vulnerability that requires Microsoft to issue a security update?
No. Microsoft recommends that all customers migrate to SHA-2, and the use of SHA-1 as a hashing algorithm for signing purposes is discouraged and is no longer a best practice. Although this is not a vulnerability in a Microsoft product, Microsoft is issuing this advisory to help clarify the actual risk involved to customers.

What causes this threat?
The root cause of the problem is a known weakness of the SHA-1 hashing algorithm that exposes it to collision attacks. Such attacks could allow an attacker to generate additional certificates that have the same digital signature as an original. The use of SHA-1 certificates for specific purposes that require resistance against these attacks is discouraged. At Microsoft, the Security Development Lifecycle has required Microsoft to no longer use the SHA-1 hashing algorithm as a default in Microsoft software. For more information about SHA-1 collision weakness, see SHAttered: The first collision for full SHA-1.

What is a digital certificate?
In public key cryptography, one of the keys, known as the private key, must be kept secret. The other key, known as the public key, is intended to be shared with the world. However, there must be a way for the owner of the key to tell the world who the key belongs to. Digital certificates provide a way to do this. A digital certificate is an electronic credential used to certify the online identities of individuals, organizations, and computers. Digital certificates contain a public key packaged together with information about it - who owns it, what it can be used for, when it expires, and so forth. For more information, see Understanding Digital Certificates.

What is the purpose of a digital certificate?
Digital certificates are used primarily to verify the identity of a person or device, authenticate a service, or encrypt files. Normally, there is no need to think about certificates at all, aside from the occasional message stating that a certificate is expired or invalid. In such cases, one should follow the instructions provided in the message.

What is a certification authority (CA)?
Certification authorities are the organizations that issue certificates. They establish and verify the authenticity of public keys that belong to people or other certification authorities, and they verify the identity of a person or organization that asks for a certificate.

Suggested Actions

Review Microsoft Trusted Root Program Policy ChangesCustomers who are interested in learning more about the topic covered in this advisory should review Windows Enforcement of SHA1 Certificates.

Update from SHA-1 to SHA-2Certificate authorities have been prohibited from issuing new SHA-1 certificates Since January 2016. Customers should ensure that their certificate authorities are using the SHA-2 hashing algorithm to obtain SHA-2 certificates from their certificate authorities. To sign code with SHA-2 certificates, see the guidance on this topic at Windows Enforcement of SHA1 Certificates.
Impact of action: Older hardware-based solutions may require upgrading to support these newer technologies.

Keep Windows UpdatedAll Windows users should apply the latest Microsoft security updates to help make sure that their computers are as protected as possible. If you are not sure whether your software is up to date, visit Windows Update, scan your computer for available updates, and install any high-priority updates that are offered to you. If you have Automatic Updates enabled, the updates are delivered to you when they are released, but you have to make sure you install them.

Other Information

Feedback

You can provide feedback by completing the Microsoft Help and Support form, Customer Service Contact Us.

Support

Customers in the United States and Canada can receive technical support from Security Support. For more information, see Microsoft Help and Support.

International customers can receive support from their local Microsoft subsidiaries. For more information, see International Support.

Microsoft TechNet Security provides additional information about security in Microsoft products.

Disclaimer
The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.
Revisions

V1.0 (May 9, 2017): Advisory published.

Click to expand...

Source: Microsoft Security Advisory 4010323

ARC1020 · Oct 8, 2018

How Can You View The SSL/TLS Certificate in Microsoft Edge

In Internet Explorer you could click on the HTTPS padlock in the address bar and click 'View Certificates', or right-click on the webpage and go to Properties > Certificates. How can you view the SSL/TLS Certificate in Microsoft Edge, without switching back to Internet Explorer?

Windows 10: Microsoft and DigiCert to begin deprecating Symantec TLS certificates

Microsoft and DigiCert to begin deprecating Symantec TLS certificates

Microsoft and DigiCert to begin deprecating Symantec TLS certificates

Microsoft and DigiCert to begin deprecating Symantec TLS certificates

Microsoft and DigiCert to begin deprecating Symantec TLS certificates - Similar Threads - Microsoft DigiCert begin

Microsoft begins deprecation of classic troubleshooting tools in Windows 11

SmartScreen warning on a exe file though it is signed by Digicert EV CS certificate

SmartScreen warning on a exe file though it is signed by Digicert EV CS certificate

Microsoft Launcher Preview Deprecation

Deprecating Legacy TLS Versions in Google Chrome

Government shutdown: TLS certificates not renewed, many websites down

How Can You View The SSL/TLS Certificate in Microsoft Edge

Deprecated

Deprecation of SHA-1 for SSL/TLS Certificates in Microsoft Edge & IE11

Users found this page by searching for:

digicert ssl error windows update

microsoft edge symantec cert block date