Skip to content
Trust revoked

Two certificate authorities booted from the good graces of Chrome

Chunghwa Telecom and Netlock customers must look elsewhere for new certificates.

Dan Goodin – | 59
The HTTPS concept with highlighted glowing S. HyperText Transfer Protocol Secure. Increasing the security of encryption. The concept of safe surfing on the net. 3D render.
Credit: Getty Images
Credit: Getty Images

Google says its Chrome browser will stop trusting certificates from two certificate authorities after “patterns of concerning behavior observed over the past year” diminished trust in their reliability.

The two organizations, Taiwan-based Chunghwa Telecom and Budapest-based Netlock, are among the dozens of certificate authorities trusted by Chrome and most other browsers to provide digital certificates that encrypt traffic and certify the authenticity of sites. With the ability to mint cryptographic credentials that cause address bars to display a padlock, assuring the trustworthiness of a site, these certificate authorities wield significant control over the security of the web.

Inherent risk

“Over the past several months and years, we have observed a pattern of compliance failures, unmet improvement commitments, and the absence of tangible, measurable progress in response to publicly disclosed incident reports,” members of the Chrome security team wrote Tuesday. “When these factors are considered in aggregate and considered against the inherent risk each publicly-trusted CA poses to the internet, continued public trust is no longer justified.”

According to Ryan Hurst, a researcher with over two decades of experience working with certificate authorities, such certificate distrust events occur about once every 15 months. The reasons for the revocations vary widely.

Hurst provided the following graph tracking the frequency of reasons for past events:

Pie chart showing reasons for distrust
Data from Ryan Hurst
Credit: Ars Technica
Data from Ryan Hurst Credit: Ars Technica

Google cited no specific incidents. Hurst, however, said past offenses included:

Chrome will stop trusting all certificates issued by Chunghwa Telecom and Netlock after July 31. Certificates issued after that date will, by default, display an error page on Chrome. The delay is designed to give those organizations' customers time to find new certificate authorities. Representatives from both organizations didn't respond to emails requesting comment.

Photo of Dan Goodin
Dan Goodin Senior Security Editor
Dan Goodin is Senior Security Editor at Ars Technica, where he oversees coverage of malware, computer espionage, botnets, hardware hacking, encryption, and passwords. In his spare time, he enjoys gardening, cooking, and following the independent music scene. Dan is based in San Francisco. Follow him at here on Mastodon and here on Bluesky. Contact him on Signal at DanArs.82.
59 Comments
Prev story
Next story