Distrust of Security Certificates

Steven Talley

A few days ago I grabbed a headline about Symantec security certificates being pulled after the Trustico CEO emailed the private keys.


While working on some website code I noticed the following warning in the Chrome console:

The SSL certificate used to load resources from https://www.sigmanu.org will be distrusted in M70. Once distrusted, users will be prevented from loading these resources. See https://g.co/chrome/symantecpkicerts for more information.

By now I can likely assume ours is not one of those 23,000 certificates being revoked immediately (since it hasn't happened yet). 
However, M70 is scheduled for an October release.  I just want to make sure that Blackbaud has a plan in place to update the certificates before that October deadline.

Tony Williams

Hi Steven,


I hope you have been well. Blackbaud is aware of the situation with Symantec and Google, and we're working to replace all certificates that been provided through Blackbaud. Additional information is outlined in the Knowledgebase solution below:

Google to distrust Symantec, what does this mean to me?

https://kb.blackbaud.com/articles/Article/115224


Thanks,

Tony

Jonathan Bowman

Just tried signing into login2.blackbaudhosting.com, and Chrome is rejecting the cert already, since I just upgraded to Chrome Build 70. As is typical in large organizations who use Chrome and Chromebooks, we keep some on the Beta channel and even a couple, like mine, on the Dev channel. This way, some of us serve as "canaries" to detect problems before they arrive to the masses. Problems like this, I suppose. 


The knowledgebase article states that "Blackbaud is updating all impacted certificates in advance."


It is August 31 and the certs have not yet been replaced. Are we waiting until October? By mid-september Chrome 70 moves into Beta.


This is obviously especially critical for Chromebook users. I am hoping the certs for hosting services can be updated soon, so that our employees can continue working.