Safari introduces more stringent HTTPS rules

Web browser icons
(Image credit: Shutterstock)

Apple has unveiled a new policy, which will go into effect later this year, that will prevent its Safari browser from accepting new HTTPS certificates that expire more than 13 months after their creation date.

As a result of the new policy, any website using long-life SSL/TLS certificates issued after the cut-off point will lead to privacy errors being displayed in the iPhone maker's browser.

Apple debuted the new policy at a recent Certification Authority Browser Forum (CA/Browser) meeting in Slovakia. According to people who attended the meeting, from September 1st any new website certificate valid for more than 398 days will not be trusted by Safari and will be rejected. However, older certificates issued before this deadline, will not be affected by this new rule.

Since Apple has made the decision to implement this new policy in Safari, the company will effectively have to enforce it on all devices running either iOS or macOS. This means that developers and website administrators will be forced to ensure that their certificates meet Apple's requirements or they'll risk losing many visitors to their sites.

One-year TLS certificates

Apple, Google and other members of CA/Browser have considered cutting certificate lifetimes for months but the policy comes with benefits as well as drawbacks.

The main goal of the policy is to help improve website security by ensuring that developers use certificates with the latest cryptographic standards while also reducing the number of old certificates that could potentially be stolen and re-used by cybercriminals launching phishing campaigns or malware attacks.

By increasing the frequency of certificate replacements, Apple will be making life more difficult for site owners as well as businesses that have to manage these certificates and compliance.

While Apple has yet to make a public announcement regarding its new policy, Digicert's Dean Coclin provided more details on how the policy will affect certificate users in a memo, saying:

“What does this mean for certificate users? For your website to be trusted by Safari, you will no longer be able to issue publicly trusted TLS certificates with validities longer than 398 days after Aug. 30, 2020. Any certificates issued before Sept. 1, 2020 will still be valid, regardless of the validity period (up to 825 days). Certificates that are not publicly trusted can still be recognized, up to a maximum validity of 825 days.”

Via The Register

TOPICS
Anthony Spadafora

After working with the TechRadar Pro team for the last several years, Anthony is now the security and networking editor at Tom’s Guide where he covers everything from data breaches and ransomware gangs to the best way to cover your whole home or business with Wi-Fi. When not writing, you can find him tinkering with PCs and game consoles, managing cables and upgrading his smart home. 

Latest in Software & Services
woman listening to computer
AWS vs Azure: choosing the right platform to maximize your company's investment
Autonomous finance
Quickbooks vs Quicken: what are the main strengths and weaknesses for your business
Group of people meeting
Zoom vs Google Meet: which is the best video conferencing tool for your business?
Person at laptop
Windows 11 vs Windows 365: which is the best choice for businesses?
A man sitting at his desk in the evening and using a desktop computer
Office 2021 vs Office 2024: is it time to upgrade?
Microsoft 365 Business app logos
Office 2024 LTSC vs Microsoft 365 Business: what are the differences?
Latest in News
Super Mario Odyssey
ChatGPT is the ultimate gaming tool - here's 4 ways you can use AI to help with your next playthrough
Brad Pitt looks over his right shoulder with 'F1' written behind him
Apple Original Films will take you behind-the-scenes of a racing cockpit in this new thrilling F1 movie trailer
AI writer
Coding AI tells developer to write it himself
Reacher looking down at another character from the Prime Video TV series Reacher
Reacher season 3 becomes Prime Video’s biggest returning show thanks to Hollywood’s biggest heavyweight
Finger Presses Orange Button Domain Name Registration on Black Keyboard Background. Closeup View
I visited the world’s first registered .com domain – and you won’t believe what it’s offering today
Image showing detail of the Leica D-Lux 8
Still can't get a Fujifilm X100VI? This premium Leica compact costs less, and it's in stock