Google raps Symantec over ‘fake web security certificate’ fiasco

Google’s blog post adds, “After this date, certificates newly issued by Symantec that do not conform to the Chromium Certificate Transparency policy may result in interstitials or other problems when used in Google products.”

While Symantec has issued a report and revealed that “23 test certificates had been issued without the domain owner’s knowledge covering five organisations, including Google and Opera,” Google is not convinced.  The search giant says it has found “more questionable certificates” being issued by Symantec. Read Symantec’s full report on the issue here.

[related-post]

An October report by Symantec had found an additional 164 certificates over 76 domains and 2,458 certificates issued for domains that were never registered. Google says that their analysis shows that Symantec had no clue about these “additional certificates.”

Google has also specifically told Symantec that it has to provide a detailed list of steps they are taking to fix this issue and a timelime for the fix. The Google blogpost adds that they expect Symantec to go in for “Point-in-time Readiness Assessment and a third-party security audit”.

In September, ArsTechnica had reported that Symantec had “fired employees for issuing unauthorised cryptographic certificates that made it possible to impersonate HTTPS-protected Google webpages.”

Symantec had written in a blogpost trying to explain the error, “All of these test certificates and keys were always within our control and were immediately revoked when we discovered the issue.” The blogpost claimed that there was no “direct impact to any of the domains.”

The problem with these fake certificates was that cyber criminals could have easily impersonated perfectly real and legal domains, resulting in data theft, phishing, etc.