Certificates Chrome Will Stop Trusting in October

A warning page instead of the site

Chrome 70 is due in mid-October. Among its changes, it stops trusting certificates from one large, older certificate authority family, sold over the years under several brand names.

A site still using one of those certificates will not load normally in Chrome. Visitors will see a full-page warning that the connection is not private, with the site hidden behind it.

The beta version of Chrome 70 has been available since last week and already behaves this way, so a few visitors may be seeing that warning now.

Most sites are not affected. The ones that are rarely know it, which is why a five-minute check is worth doing this week.

Why a browser stops trusting certificates

A certificate is only worth something because browsers trust the authority that issued it to check who controls a domain.

When browser makers lose confidence in how an authority has issued certificates, they can withdraw that trust. Last year they announced they would do so for this family in stages, to give site owners time to replace their certificates.

Chrome 70 is Chrome's final stage. Other browser makers have announced similar steps on their own timetables.

The certificates have not expired, and nothing on your server changes. The browser simply stops accepting them.

What breaks

• The home page is replaced by a full-page warning.
• Forms, checkouts and logins sit unreachable behind it.
• Links in emails and posts land on the same warning.
• Scripts, fonts or payment boxes from an affected address fail silently.
• A store or portal on a subdomain breaks on its own certificate.

The fourth catches sites whose own certificate is fine. If a page loads something from another address that uses an affected certificate, Chrome 70 will not load it, and the page appears with a piece missing.

Finding who issued your certificate

In Chrome on a computer, click the padlock beside the address and open the certificate. The window shows who it was issued to, who issued it, and the dates it is valid between.

The issuer named there is often not the company you paid. Hosts and resellers sell certificates from several authorities, sometimes under names of their own.

So the brand on the invoice is not a reliable guide in either direction. Note the issuer and the dates, then run the check that settles it.

The check that settles it

Chrome will tell you itself. Open the site in the current version of Chrome on a computer, then open the developer tools: F12, or Control, Shift and I, on Windows; Option, Command and I on a Mac.

Choose the Console tab and reload the page. If a certificate the page depends on will stop working in Chrome 70, a message there says so and names the address concerned.

That covers the page's own certificate and anything it loads from elsewhere. Repeat it on each part of the site: the home page, the store, the booking page, the client login.

Whoever maintains your site can run the same check across every address the business uses in a few minutes.

Every address has its own certificate

A certificate covers the names listed in it. The main site, a store on a subdomain and a booking portal may each have a different certificate, bought at a different time by a different person.

The affected ones are usually older, often multi-year certificates installed once and never looked at again.

List every address the business uses and check each one, not just the home page.

A worked example

A data recovery service in a business park takes in failed drives from homes and offices. Customers check on their job, and approve quotes, through a client portal that lives on its own subdomain.

The main site had moved to a free certificate from the host that renews itself. The portal still had a three-year certificate bought two years ago by the developer who built it, who has since moved on.

The office manager ran the console check after a customer testing a preview version of Chrome phoned to say the portal showed a security warning. The main site came back clean; the portal was flagged.

The host issued a free, automatically renewing certificate for the portal's subdomain that afternoon.

Before anyone called it done, the portal's login, quote approval and file download were tested in Chrome, Safari and Firefox, on a computer and on a phone.

Replacing an affected certificate

Start with whoever sold it. Replacements for affected certificates have often been provided at no charge, so ask before buying another.

The alternative on many hosts is a free certificate that renews itself, with the same encryption as a paid one.

Either way, the new certificate has to be installed with its intermediate certificates, the links that connect it to a trusted authority.

A missing intermediate shows warnings on some phones and browsers but not others, which makes it easy to overlook.

Files your pages borrow

A page that loads a script, font, map or payment form from a supplier depends on that supplier's certificate as well as your own.

If the console check flags an address that is not yours, the fix belongs to the supplier. Contact them now and ask whether a replacement is already in hand.

Where a supplier cannot fix it in time, remove or replace that piece of the page, since in Chrome 70 it will be missing anyway.

The counter-case

For most sites, this check finds nothing.

A site on a free certificate that renews itself, or on a recent certificate from another authority, has nothing to replace, and should not buy a new certificate out of caution.

A site whose visitors mostly use other browsers has a little longer, though not much, since those browsers are taking similar steps.

Run the check anyway, on every address, and replace anything it flags before Chrome 70 arrives.

Before Chrome 70

1. List every address the business uses.
2. Note who issued each certificate.
3. Run the console check on each address.
4. Ask the seller about a free replacement.
5. Install it with its intermediate certificates.
6. Contact suppliers whose files are flagged.
7. Test forms and logins afterwards.

Step three settles the question. A certificate's brand and issuer can both mislead, but Chrome's own message says plainly whether an address will stop working.

Testing forms after any change on the server is the same habit described in caching that breaks the contact form.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.