Migrate from Symantec certificates

Work with your website administrator to identify where you use Symantec certificates in your domains, and replace these as soon as possible. You can use a certificate from any Certificate Authority trusted by Chrome. This includes DigiCert which has purchased Symantec's business.

Some legacy devices, such as point-of-sale terminals, phone systems, or other forms of integrated hardware, are only capable of trusting Symantec certificates. If this applies to you, contact the device suppliers and ask them to support other Certificate Authorities.

If your devices can’t be updated immediately, and they use the same web servers as your Chrome users, you can enable temporary support for Symantec certificates until you replace or upgrade your devices. If this applies to you, contact the DigiCert representative assigned to your Symantec account to develop a plan to transition to a new Certificate Authority.

If your enterprise depends on a partner site that uses Symantec certificates, contact the website administrator to find out their schedule for replacing the certificates. These sites should transition their certificates immediately, to avoid any disruption to your enterprise

If your partner can’t update their site immediately, consider enabling temporary support for Symantec certificates, until the site is updated.

• ChromeOS will support this policy until version 73. However, other OS’s such as Windows, Linux, or macOS could remove support for Symantec certificates before Chrome 73 is released. If your users are running the Chrome browser on an OS that no longer supports Symantec certificates, enabling this policy will have no effect and the certificates will not be trusted.
• Enabling this policy is only a temporary solution to give you more time to transition to a permanent solution. Plan your migrations so that your users can access critical webpages during this transition.
• Before rolling out this policy across your organization, test to make sure that your users can still access the sites they need to with this policy enabled.
• This policy lets websites continue to use legacy certificates, and users visiting these sites won’t see any alerts or messages. Enabling this policy could make it difficult for you to discover which servers and sites are using legacy certificates. During the transition period, you should regularly test sites with this policy disabled to determine which sites or services need to be updated.

Applies when users use a Chrome browser on a ChromeOS device.

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  DevicesChromeSettings. The User & browser settings page opens by default.

   If you signed up for Chrome Enterprise Core, go to Menu  Chrome browserSettings.

3. (Optional) To apply the settings to an organization or group:
   1. On the left, select the organization or group.
   2. Make sure Managed Chrome Browser is turned on for this organization or group.
      Group settings override organizational units. Learn more .
4. Go to the Security.
5. Click Local trust anchor certificates.
6. From Symantec Corporation’s legacy PKI infrastructure, select one of the following:
   1. Allow - allows legacy certificates issued by Symantec to be trusted.
   2. Block - blocks legacy certificates issued by Symantec. This setting enforces the ChromeOS default behavior. Which certificates are blocked depends on the ChromeOS version and the date the certificates were created. See this table for more information.
7. Click Save. Or, you might click Override for an organizational unit.

   To later restore the inherited value, click Inherit (or Unset for a group).

   
   Settings typically take effect in minutes, but can take up to an hour to apply for everyone.

Applies when users use Chrome browser on Windows.

Using Group policies

Before you begin: Set up Chrome policies (Windows)

On your Windows computer

1. Open your Group Policy Management Console.
2. Go to User ConfigurationPoliciesAdministrative TemplatesGoogleGoogle Chrome.
3. Click Enable trust in Symantec Corporation’s Legacy PKI Infrastructure.
4. Select Enabled.
5. Click OK

Applies when users use Chrome browser on macOS.

Before you begin: Set up Chrome policies (macOS)

In your Chrome configuration profile, add or update the following key. Then deploy the change to your users.

• Set the EnableSymantecLegacyInfrastructure key to true:
  <key>EnableSymantecLegacyInfrastructure</key>
     <true/>

Applies when users use Chrome Browser on Linux.

Using your preferred JSON file editor:

1. Go to your /etc/opt/chrome/policies/managed folder.
2. Create a new JSON file. Or open an existing JSON file.
3. Update the file with the following code:
   {
"EnableSymantecLegacyInfrastructure": "true"
}
4. Deploy the update to your users.