Information about distrusting Symantec certificate authorities

Find out about the actions Apple is taking to distrust Symantec certificate authorities.

As of 1 August 2018, Apple partially distrusted Symantec Certificate Authorities (CAs).

Website operators, system administrators and software developers using Symantec certificates need to transition to a certificate issued by an Apple-trusted CA.1

For site operators using Symantec Transport Layer Security (TLS) server certificates that were issued between 1 June 2016 and 1 December 2017, these certificates were trusted until the full distrust of Symantec CAs on 25 February 2020.

All other TLS server certificates issued by Symantec are distrusted.

Timeline

Starting 1 August 2018: Partial distrust of Symantec CAs 

  • TLS server certificates issued before 1 June 2016 or after 1 December 2017 are distrusted.
  • TLS server certificates issued between 1 June 2016 and 1 December 2017 are trusted if they have been published to a trusted CT log.2

25 February 2020: Full distrust of Symantec CAs

  • TLS server certificates issued from Symantec CAs listed below are fully distrusted.

13 September 2021: Ongoing distrust of Symantec CAs

  • All certificates issued from Symantec CAs listed below are fully distrusted. The exemption list has been updated.

November 2021

  • The exemption list has been updated.

February 2022

  • The exemption list has been updated.

Symantec Root CAs with these constraints applied

The following Symantec Root CAs have these constraints applied:

  • GeoTrust Global CA (FF:85:6A:2D:25:1D:CD:88:D3:66:56:F4:50:12:67:98:CF:AB:AA:DE:40:79:9C:72:2D:E4:D2:B5:DB:36:A7:3A)
  • VeriSign Class 1 Public Primary Certification Authority — G3 (CB:B5:AF:18:5E:94:2A:24:02:F9:EA:CB:C0:ED:5B:B8:76:EE:A3:C1:22:36:23:D0:04:47:E4:F3:BA:55:4B:65)
  • VeriSign Class 2 Public Primary Certification Authority — G3 (92:A9:D9:83:3F:E1:94:4D:B3:66:E8:BF:AE:7A:95:B6:48:0C:2D:6C:6C:2A:1B:E6:5D:42:36:B6:08:FC:A1:BB)
  • VeriSign Class 3 Public Primary Certification Authority — G3 (EB:04:CF:5E:B1:F3:9A:FA:76:2F:2B:B1:20:F2:96:CB:A5:20:C1:B9:7D:B1:58:95:65:B8:1C:B9:A1:7B:72:44)
  • VeriSign Class 3 Public Primary Certification Authority — G4 (69:DD:D7:EA:90:BB:57:C9:3E:13:5D:C8:5E:A6:FC:D5:48:0B:60:32:39:BD:C4:54:FC:75:8B:2A:26:CF:7F:79)
  • VeriSign Class 3 Public Primary Certification Authority — G5 (9A:CF:AB:7E:43:C8:D8:80:D0:6B:26:2A:94:DE:EE:E4:B4:65:99:89:C3:D0:CA:F1:9B:AF:64:05:E4:1A:B7:DF)
  • VeriSign Universal Root Certification Authority (FB:2B:D3:59:81:44:35:6D:CB:D2:B2:59:E8:F3:EB:D0:B0:F6:EE:18:0C:15:EF:55:3B:82:D1:99:EF:07:F3:9A)
  • thawte Primary Root CA (8D:72:2F:81:A9:C1:13:C0:79:1D:F1:36:A2:96:6D:B2:6C:95:0A:97:1D:B4:6B:41:99:F4:EA:54:B7:8B:FB:9F)
  • GeoTrust Primary Certification Authority (37:D5:10:06:C5:12:EA:AB:62:64:21:F1:EC:8C:92:01:3F:C5:F8:2A:E9:8E:E5:33:EB:46:19:B8:DE:B4:D0:6C)
  • thawte Primary Root CA — G2 (A4:31:0D:50:AF:18:A6:44:71:90:37:2A:86:AF:AF:8B:95:1F:FB:43:1D:83:7F:1E:56:88:B4:59:71:ED:15:57)
  • thawte Primary Root CA — G3 (4B:03:F4:58:07:AD:70:F2:1B:FC:2C:AE:71:C9:FD:E4:60:4C:06:4C:F5:FF:B6:86:BA:E5:DB:AA:D7:FD:D3:4C)
  • GeoTrust Primary Certification Authority — G2 (5E:DB:7A:C4:3B:82:A0:6A:87:61:E8:D7:BE:49:79:EB:F2:61:1F:7D:D7:9B:F9:1C:1C:6B:56:6A:21:9E:D7:66)
  • GeoTrust Primary Certification Authority — G3 (B4:78:B8:12:25:0D:F8:78:63:5C:2A:A7:EC:7D:15:5E:AA:62:5E:E8:29:16:E2:CD:29:43:61:88:6C:D1:FB:D4)
  • Symantec Class 1 Public Primary Certification Authority — G4 (36:3F:3C:84:9E:AB:03:B0:A2:A0:F6:36:D7:B8:6D:04:D3:AC:7F:CF:E2:6A:0A:91:21:AB:97:95:F6:E1:76:DF)
  • Symantec Class 3 Public Primary Certification Authority — G4 (53:DF:DF:A4:E2:97:FC:FE:07:59:4E:8C:62:D5:B8:AB:06:B3:2C:75:49:F3:8A:16:30:94:FD:64:29:D5:DA:43)
  • Symantec Class 1 Public Primary Certification Authority — G6 (9D:19:0B:2E:31:45:66:68:5B:E8:A8:89:E2:7A:A8:C7:D7:AE:1D:8A:AD:DB:A3:C1:EC:F9:D2:48:63:CD:34:B9)
  • Symantec Class 2 Public Primary Certification Authority — G4 (FE:86:3D:08:22:FE:7A:23:53:FA:48:4D:59:24:E8:75:65:6D:3D:C9:FB:58:77:1F:6F:61:6F:9D:57:1B:C5:92)
  • Symantec Class 3 Public Primary Certification Authority — G6 (B3:23:96:74:64:53:44:2F:35:3E:61:62:92:BB:20:BB:AA:5D:23:B5:46:45:0F:DB:9C:54:B8:38:61:67:D5:29)
  • Symantec Class 2 Public Primary Certification Authority — G6 (CB:62:7D:18:B5:8A:D5:6D:DE:33:1A:30:45:6B:C6:5C:60:1A:4E:9B:18:DE:DC:EA:08:E7:DA:AA:07:81:5F:F0)

Symantec customer-operated CAs exempt from these constraints

[
    {
        "DN": "CN=Apple IST CA 2 - G1, OU=Certification Authority, O=Apple Inc., C=US",
        "SHA256FP": "ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b"
    },
    {
        "DN": "CN=Apple IST CA 8 - G1, OU=Certification Authority, O=Apple Inc., C=US",
        "SHA256FP": "a4fe7c7f15155f3f0aef7aaa83cf6e06deb97ca3f909df920ac1490882d488ed"
    },
    {
		"DN": "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root G2",
		"SHA256FP": "2d4fad3455ab61397401abbb518922f84336b67e02fc8d2db283825c4ab981bb"
	},
	{
		"DN": "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root G2",
		"SHA256FP": "aadadd5a879d2eb8c41a89597291292709d42052f5b6399541c694c3b7353cd1"
	}
]

Information about products not manufactured by Apple, or independent websites not controlled or tested by Apple, is provided without recommendation or endorsement. Apple assumes no responsibility with regard to the selection, performance or use of third-party websites or products. Apple makes no representations regarding third-party website accuracy or reliability. Contact the vendor for additional information.

Published Date: