¶ºÒõ¹Ý

A recent Google Ìýsays all publicly trusted SSL/TLS certificates issued in April 2018 or later will be expected to comply with Chrome’s Certificate Transparency (CT) policy in order to be trusted by that browser.

Since January 2015, Chrome has required Extended Validation (EV) certificates to comply with CT, but now with this policy change, it will also apply to Domain Validated (DV) and Organization Validated (OV) certificates.

What Does This Mean for ¶ºÒõ¹Ý Customers?

Fortunately, for ¶ºÒõ¹Ý customers, our systems have been and remain ready for this new policy. Beyond logging your EV certificates to CT, many of you have taken advantage of our CT implementation to test your systems with OV certificates.

For those of you who haven't done this yet, there is plenty time of time before the 2018 compliance deadline to conduct tests. To start, opt-in for CT within your administrator account. For those wanting to turn on CT by default ahead of the deadline, contact our support team by email at support(at)digicert(dot)com, live chat, or phone (801) 701-9600.

¶ºÒõ¹Ý at the Forefront of CT Development

¶ºÒõ¹ÝÌýparticipated in early pilots with Google during 2013 and implemented full CT capabilities in late 2013 that allowed our customers to opt-in at that time. To further our commitment, we began logging all EV certificates ahead of the January 2015 deadline, and we became the first approved, non-Google entity to operate a CT log beginning on January 1, 2015.

For more than two years, ¶ºÒõ¹Ý has advocated for Chrome to make CT a mandatory requirement for all certificates because we believe it enhances the SSL/TLS ecosystem, providing early detection of misissued certificates. The transparency of CT improves the integrity of Certificate Authority (CA) practices and provides additional protections for domain holders.

While this is a positive step forward for the industry, we feel that there is still important work to do before the April 2018 deadline in order to assure CT meets the interests of the security community and domain holders.

For example, name redaction is an important matter to us and the community at-large for the following reasons:

Security: Some companies use DNS as a network map. Absent name redaction, some companies may publicly end up disclosing more corporate structure information than intended. Propriety: When deploying pre-launch websites for projects, companies often want to use a trusted certificate, but for obvious reasons, do not want to give away any secrets that could hurt their market position. Privacy: Certificates may include personal information about a company or their staff. Redacting this information would provide important protection.

¶ºÒõ¹Ý remains committed to advancing Internet security standards and practices that protect online trustworthiness. In doing so, we feel it important to balance the legitimate needs of organizations in protecting their trade secrets and maintaining business advantages.