Chrome 70: Symantec Certificate Distrust Could Take Your Site Offline

A few weeks ago, for its 10th birthday, Chrome moved to version 69: new features, a new look, a second youth for Google’s browser. Google isn’t stopping there, though. Chrome 70 is due in a few days, and it brings tighter security rules that could break access to many websites, including some very popular ones. Here’s what’s happening with the Symantec certificate distrust.

From HTTP to HTTPS

Google’s intent is clear: make browsing as secure as possible. For several years now, it has been pushing every website to move from HTTP to HTTPS.

Google took the first step in January 2017, flagging as “Not secure” HTTP pages that collect sensitive information such as passwords or credit card numbers. With Chrome 68 in July 2018, it extended that label to every HTTP page. Google’s goal? Make HTTPS the default.

Chrome 70 and Old Symantec Certificates Don’t Mix

Even HTTPS sites aren’t all safe from trouble. Sites using a certificate issued by Symantec’s legacy infrastructure are affected, and that includes the brands Symantec, Thawte, VeriSign, Equifax, GeoTrust, and RapidSSL.

Chrome 66 already stopped trusting the oldest of these certificates, those issued before June 1, 2016. With Chrome 70, Google removes trust in the whole legacy Symantec infrastructure, whatever the issue date. Affected sites will no longer load normally in the browser.

In practice, visitors trying to reach one of these sites will see a full-page security warning that stops them from going any further.

Why? Google found that Symantec had repeatedly mis-issued certificates, so its legacy certificates could no longer be trusted to provide proper security.

Google announced this change back in 2017, yet many sites are still affected, including some heavily visited and authoritative ones, such as banks and government sites. Ferrari’s website was still on the list just a few days ago.

If your site is affected, it isn’t too late, but time is short: Chrome 70 is scheduled to reach users on October 16, 2018. The fix is to replace the certificate with a new one from a trusted certificate authority, something your web host or web design agency can usually handle quickly. If you’re moving a site to HTTPS at the same time, Search Console now alerts you when an HTTPS migration goes wrong.

Not Sure Whether Your Site Is Affected?

Référenceur, a French-speaking digital marketing agency from Belgium and Luxembourg, works with U.S. businesses remotely, through video calls, shared screens, and monthly reporting. Request a free assessment and we’ll check your certificate and HTTPS setup.

Where Things Stand in 2026

DigiCert acquired Symantec’s certificate business in 2017 and reissued certificates on its own trusted infrastructure, so Symantec-era certificates have long since disappeared from the web. HTTPS is now the norm (Google even added an HTTPS report to Search Console in 2022), and an expired or untrusted certificate still triggers a full-page warning in every major browser.