Google 的 Ryan Sleevi 宣佈了對 Symantec 所發佈的的 SSL Certificate 的不信任計畫：「Intent to Deprecate and Remove: Trust in existing Symantec-issued Certificates」。
這邊講「不信任計畫」，主要是因為 Google Chrome 不是打算移除，而是限制 Symantec 發出的 SSL certificate 的有效期限。這有種 too big to fail 的感覺...
以市占率來看，無論是「Usage of SSL certificate authorities for websites」這邊算出來的 15.4%，或是「SSL Market Share Report」這邊算出來的 24%，移除的影響都是巨大無比，再加上歷史上最早一批 CA 公司幾乎都被 Symantec 買進去 (像是 Verisign、Thawte)：
This compatibility risk is especially high for Symantec-issued certificates, due to their acquisition of some of the first CAs, such as Thawte, Verisign, and Equifax, which are some of the most widely supported CAs. Distrusting such CAs creates further difficulty for providing secure connections to both old and new devices alike, due to the need to ensure the CA a site operator uses is recognized across these devices.
所以不信任計畫將會不會採取移除，而是其他方式：
To balance the compatibility risks versus the security risks, we propose a gradual distrust of all existing Symantec-issued certificates, requiring that they be replaced over time with new, fully revalidated certificates, compliant with the current Baseline Requirements. This will be accomplished by gradually decreasing the ‘maximum age’ of Symantec-issued certificates over a series of releases, distrusting certificates whose validity period (the difference of notBefore to notAfter) exceeds the specified maximum.
也就是後面的每一個新版的 Google Chrome 都會降低對 certificate 可以設定的有效期限，直到降到九個月 (279 天)：
The proposed schedule is as follows:
Chrome 59 (Dev, Beta, Stable): 33 months validity (1023 days)
Chrome 60 (Dev, Beta, Stable): 27 months validity (837 days)
Chrome 61 (Dev, Beta, Stable): 21 months validity (651 days)
Chrome 62 (Dev, Beta, Stable): 15 months validity (465 days)
Chrome 63 (Dev, Beta): 9 months validity (279 days)
Chrome 63 (Stable): 15 months validity (465 days)
Chrome 64 (Dev, Beta, Stable): 9 months validity (279 days)
另外安全標示也將會被拔除：
Therefore, we propose to remove such indicators, effective immediately, until Symantec is able to demonstrate the level of sustained compliance necessary to grant such trust, which will be a period no less than a year. After such time has passed, we will consider requests from Symantec to re-evaluate this position, in collaboration with the broader Chromium community.
接下來看 Mozilla 端會不會有類似的動作了...