Certain old Symantec SSL-certificates will not be supported by webbrowsers. Google Chrome will stop supporting these certificates with version 70, which will be released on Tuesday October 16th. Firefox will follow soon with a similar update. Open State Foundation has scanned public and private websites to see how many Dutch websites still use these old certificates. A scan of 16.085 Dutch websites that use Symantec SSL-certificates shows that 3.106 websites still use old certificates. 19 percent of scanned websites will not be automatically accessible with Google Chrome.
Visiting these websites will prompt an automatic warning by the browser. The visitor will be warned that the connection is not private and is advised not to visit the website. The website is still accessible, but only after dismissing the warning. Google Chrome and Firefox were both planning to stop supporting the certificates this week. Due to the large amount of websites still using the old certificates, Firefox postponed the release. The new Open State scan shows that one in five websites will prompt a warning as of the 16th of October.
One percent of public websites not updated
Every quarter Open State Foundation uses Pulse to scan the amount of public sector organizations (government, health and education) that protect their website with HTTPS. Pulse scans a total of 20.996 public websites that use SSL-certificates. The new scan shows that still 189 of these websites use the old Symantec SSL-certificates. That is almost one percent. A few examples are www.heemskerk.nl, https://zutphen.nl, https://allerzorg.nl, https://www.vechtstromen.nl/, https://www.amaris.nl and https://www.bsgw.nl.
Certificate Transparency Log scan
A different scan with 16.085 websites from the Certificate Transparency Log, where all the published Symantec-certificates can be found, shows that 3.106 websites still use the old certificates. Almost twenty percent. Some examples are https://www.ekoplaza.nl, https://www.emte.nl, https://loi.nl en anpfoto.nl. It is surprising that so many websites still have not been updated, despite the early warnings by Mozilla Firefox and Google Chrome. The public sector is doing a better job in updating their websites.
Full scan results
Curious to find out which websites still use the old certificates? See the complete overview.
