9/23/2014
Dear Valued Client,
You may have recently received a notification from GoDaddy regarding upgrading your website’s SSL certificate. We wanted to take this opportunity clarify the message and highlight what is required from you in the short and long terms.
To start, SSL certificates are a secure means of transporting sensitive information between your website and a user. On ClubHouse Online e3, certificates are primarily used on Login pages, Member Statements and the Member Roster, where sensitive information should be encrypted to prevent anyone from obtaining it electronically between these two sources. A website using SSL will show a tiny lock icon within the web browsers address bar:
There are various methods of encryption for SSL certificates – the most common one being SHA-1, which is older, however, effective algorithm for encrypting information in transit. Google has decided it’s time to sunset this encryption algorithm.
You can read more about Google’s decision at:
http://googleonlinesecurity.blogspot.ca/2014/09/gradually-sunsetting-sha-1.html
How does this affect your Google Chrome users on your website?
To briefly explain what Google intends to do within Chrome:
1.This November, any SHA-1 certificate that expires after January 1st, 2017 will have a little warning icon, in addition to the lock, noting a potential problem with the website’s certificate. This will only happen if your certificate expires after January 1st, 2017.
2. Early 2015, any SHA-1 certificate that expires after January 1st, 2017 will display a page icon in lieu of a lock, indicating that the site is "Neutral, lacking security".
3. Certificates that expire between January 1 and December 31, 2016 will have a warning icon, in addition to the lock, noting a potential problem with the website’s certificate.
4. By mid-2015 - any SHA-1 certificate that expires after January 1st, 2017 will be identified as insecure, https:// will be highlighted in red, and a red x will be displayed over the lock icon.
Certificates that expire between January 1 and December 31, 2016 continue to display the lock icon with yellow arrow to indicate that the site remains “Secure, but with minor errors.”
It is important to note two things:
-
Your current certificate, if using SHA-1, will continue to encrypt data on your website as it always has in Google Chrome (and other browsers).
-
At this time, Google Chrome users of your website will not receive any prompt by the browser notifying them of potential problems with your website.
You do not need to take immediate action.
For certificates expiring before January 1, 2016 – when it is time to renew your certificate, ensure to switch the level of encryption to SHA-2.
For certificates expiring after January 1, 2016, it is not a requirement to take any action before your renewal date, however, note that Google Chrome users may take notice of the changed security icon (or the lack of any icon) and inquire with the club, but will not see any immediate pop up message noting the site is vulnerable. If you are interested in ensuring no visible impact to your site’s users, you may wish to follow GoDaddy’s instructions. You or your IT professional may have already received these instructions via email this week.
More information can be found on GoDaddys security blog:
https://garage.godaddy.com/webpro/security/google-chrome-phasing-ssl-certs-using-sha-1/?isc=gd4948w&xid=WUNkfHxaQlZla3pnX2N4Wll5Ez8tAV9-2FN3wGYGMDdF1QFUZJd3xdDV5HQg-3D-3D&cvosrc=email.house.gd4948w
Thank You,
ClubHouse Online Support
Latest news RSS