Certificate Authorities change which root CA certificates they use from time to time, so we have always provided a list of
certificates that we currently use or may use in the future. Anybody using this list won’t have to change anything. If you have not been using this list and updating it based on our published guidance, you will need to update your application to use these roots and regularly update the list you use so future changes go smoothly for your users.
I am a website operator that uses Google Trust Services certificates. Do I need to change anything?
You do not! Google Trust Services offers certificates to Alphabet products and services including many Google Cloud services. This means that those services are the ones responsible for configuring and managing TLS for you.
When will this change go into effect?
We will begin rolling out certificate chains that use this cross-certificate in March 2021. We will slowly roll these changes out throughout the rest of the year and will complete them before December 15, 2021.
I use a service or product that uses Google Trust Services. Is there anything I need to change? No, this change should be invisible to all end users.
How can I test to see if my devices will trust certificates that rely on this cross-sign?
We operate a test site that uses the cross-certificate that you can visit
here. If you see "Google Trust Services Demo Page - Expected Status: good" and some additional certificate information, the new certificate chain works correctly on your device. If you get an error, the list of trusted roots for the device you're testing needs to be updated.
When does this cross-certificate expire and what happens when it does?
The cross-certificate expires January 28th, 2028. Sometime between now and when it looks like it is no longer needed for broad device compatibility, we will stop providing this extra certificate to certificate requesters, as it will no longer be needed.
I use an old device and it does not trust the cross-sign. What should I do?
Many devices handle root certificate updates as part of their security patching process. If you are running one of these devices, you should make sure you apply all relevant security updates. It is also possible the manufacturer no longer provides security updates for your device. If this is the case you may want to contact your provider or consider replacing your device.
Does this mean you are no longer using the Google Trust Services roots? We are still using the Google Trust Services roots, they are simply cross-signed. When it is no longer necessary to use the cross-sign, we will no longer distribute the cross-sign to certificate requestors.
Follow
沒有留言 :
張貼留言