La méfiance de Google à l'égard d'Entrust : Ce que les entreprises doivent savoir

There is a lot to learn from last week’s news regarding Google’s decision to distrust Entrust for Google Chrome. Any certificate issued from Entrust root certificate authorities (CA) after October 31, 2024 will no longer be trusted by the Google Chrome browser. 

According to reports, Google’s decision to part ways with Entrust’s public certificate authorities (CAs) is due to an “observed pattern of compliance failures, unmet improvement commitments, and the absence of tangible, measurable progress in response to publicly disclosed incident reports.” Digital certificates have been mis-issued which has led to overall security implications. While unfortunate, Google’s response is intended to preserve the integrity of Web public key infrastructure (PKI). In today’s increasingly digital world, PKI is critical to protect the confidentiality and authenticity of communication between web browsers and web content servers. PKI  is what ensures digital trust in our online world.

Qu'est-ce que cela signifie pour les entreprises ? 

Les entreprises qui souhaitent que leurs sites web et applications publics soient accessibles par le navigateur Chrome, qui représente plus de 65 % de tous les utilisateurs d'Internet, devront planifier la migration et veiller à ce que les certificats émis par Entrust qui arrivent à expiration soient renouvelés et remplacés par des certificats émis par une autre autorité de certification de confiance.

Que pouvons-nous apprendre de cette décision ? 

There are four major lessons from Google’s recent decision to distrust Entrust. 

First is the importance of CA-agility. When it comes to leveraging public CAs, there is always the risk that a CA will revoke certificates or be distrusted from web browser trust stores (this has happened several times in the past few years). To minimize this risk and prevent disruption, businesses must maintain the ability to easily add, switch, and migrate CAs, or have a multi-CA strategy. 

Second is the critical need for crypto-agility. Every CA makes mistakes and web browsers are forced to make the difficult decision to revoke certificates. In fact, this has happened several times over the last year, such as Mozilla’s distrust in Entrust public CAs in May. Organizations must be able to handle revocations at scale and install new certificates in place of old ones, without disrupting business operations.

Third, businesses shouldn’t put all their eggs in one public CA’s basket. Companies should also avoid using public CAs for anything other than entities that require public trust, such as public-facing websites and applications (i.e., for a mobile app that speaks to the cloud). With private PKI, encryption within an organization’s internal servers and systems is deployed to verify the authenticity of users and devices. In this instance, private CAs are created to issue certificates and they are managed internally, reducing the risk of unauthorized access and potential compromise by external entities. 

Dans notre monde numérique, la confiance est primordiale et le site privé PKI permet aux entreprises d'offrir à ceux qui se fient à leurs autorités de certification un degré de confiance plus élevé.

Fourth, this situation is an early warning sign of what’s to come for post-quantum cryptography (PQC). Replacing all publicly trusted certificates from a CA is a drop in the bucket compared to what will be required to migrate to quantum-safe algorithms. This decision is a good reminder that businesses must start planning for the transition to PQC algorithms as early as possible to avoid catastrophic disruptions. 

How can Keyfactor help? 

En prévision de la prochaine modification de Chrome, les responsables de l'informatique et de la sécurité doivent évaluer avec soin leurs sites PKI et leurs certificats. Les entreprises doivent agir rapidement pour identifier et remplacer les certificats affectés, et c'est un processus qui ne peut pas être réalisé manuellement.

With Keyfactor Command, customers gain the visibility and automation needed to make the transition to a new CA seamlessly. Keyfactor Command gives businesses a view into all their certificates from a single dashboard, helping them to identify and remediate risks fast with a simple search-and-click engine. 

Les utilisateurs peuvent également tirer parti de Keyfactor Orchestrators et de plugins prédéfinis pour automatiser le renouvellement, l'approvisionnement et l'installation des certificats en un seul clic ou sans aucun clic. Pour ceux qui utilisent les certificats numériques d'Entrust, les offres Command de Keyfactoroffrent la flexibilité nécessaire pour migrer PKI et la gestion des certificats sans perturber la productivité.

When it comes to preparing for PQC, businesses can leverage Keyfactor’s PQC Lab – a free, SaaS-based sandbox that enables teams to generate a PQC-ready CA and start issuing quantum-resilient certificates in minutes. The sandbox is now available in Azure.

Principaux enseignements pour la gestion des certificats à l'avenir

La décision de Google de se méfier d'Entrust est un signal d'alarme pour les entreprises. La confiance numérique n'est pas statique ; elle est toujours menacée. 

Pour rester résilientes, les entreprises ont besoin d'une visibilité totale de tous les certificats, de la possibilité d'automatiser le remplacement des certificats et la remédiation à grande échelle et, surtout, de la flexibilité d'ajouter, de migrer ou de changer d'autorité de certification sans provoquer d'interruption. 

To learn more about how Keyfactor can help your organization navigate this transition, please reach out here.