The end for 1024-bit SSL certificates is near, Mozilla kills a few more

Website owners still using 1024-bit SSL certificates should replace them with 2048-bit ones

Website owners take notice: In weeks, Mozilla products including its popular Firefox browser will stop trusting an unknown number of SSL certificates that were issued using old root CA certificates with 1024-bit RSA keys.

The move is part of the organization's efforts that started in September to force certificate authorities (CAs) and their customers to stop using 1024-bit certificates, which are considered cryptographically unsafe because of advances in computing power.

"If you manage an SSL-enabled website, this change will not impact you if your certificates and the certificates above it have 2048-bit keys or more," the Mozilla security engineering team said Wednesday in a blog post. "If your SSL certificate has a 1024-bit key, or was issued by a certificate with a 1024-bit key, then you will need to get a new SSL certificate, and update the certificates in your Web server."

Owners of 2048-bit certificates that chain back to intermediate CA certificates with 1024-bit keys will also be impacted if they don't update the certificate chain on their Web servers to include a 2048-bit intermediate from their certificate authority.

Each certificate authority has one or more root certificates that it uses to sign SSL certificates with when issuing them to customers. Those CA certificates are included in operating systems, major browsers and other products according to well established agreements and are used to verify the authenticity of SSL certificates presented by websites.

In Firefox 36, which is currently in beta testing but is scheduled to be released on Feb. 24, Mozilla removed five 1024-bit CA certificates owned by Verizon and Symantec. The certificates flagged for removal are: GTE CyberTrust Global Root, Thawte Server CA, Thawte Premium Server CA, Class 3 Public Primary Certification Authority -- G2 and Equifax Secure eBusiness CA-1.

This means that Firefox 36 and later will no longer trust SSL certificates that chain back to one of those roots and will display an untrusted connection error when encountering such certificates online.

Mozilla already removed eight other 1024-bit CA certificates in September, in Firefox 32. Those belonged to Entrust, SECOM, GoDaddy, EMC/RSA, VeriSign (now Symantec) and NetLock.

The third and final phase of this process is also expected to happen during the first half of this year and will involve the removal of two more Equifax root certificates owned by Symantec. According to a note on the Mozilla bug tracker from earlier this week, one of those two Equifax root certificates is still "very widely used."

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Tags online safetysymantecsecurityverizonencryptionprivacymozillapki

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Essentials

Lexar® JumpDrive® S57 USB 3.0 flash drive

Learn more >

Microsoft L5V-00027 Sculpt Ergonomic Keyboard Desktop

Learn more >

Mobile

Lexar® JumpDrive® S45 USB 3.0 flash drive 

Learn more >

Exec

Lexar® Professional 1800x microSDHC™/microSDXC™ UHS-II cards 

Learn more >

HD Pan/Tilt Wi-Fi Camera with Night Vision NC450

Learn more >

Audio-Technica ATH-ANC70 Noise Cancelling Headphones

Learn more >

Lexar® JumpDrive® C20c USB Type-C flash drive 

Learn more >

Budget

Back To Business Guide

Click for more ›

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?