{"id":2891,"date":"2017-01-27T03:17:20","date_gmt":"2017-01-27T11:17:20","guid":{"rendered":"https:\/\/cheapsslsecurity.com\/blog\/?p=2891"},"modified":"2021-01-26T09:13:10","modified_gmt":"2021-01-26T17:13:10","slug":"google-chrome-56-will-label-websites-without-ssl-not-secure","status":"publish","type":"post","link":"https:\/\/cheapsslsecurity.com\/blog\/google-chrome-56-will-label-websites-without-ssl-not-secure\/","title":{"rendered":"Google Chrome 56 Will Label Websites Without SSL \u201cNot Secure\u201d"},"content":{"rendered":"

Upcoming changes in Google Chrome will have a major impact on the internet.<\/h2>\n

Google Chrome 56, due out at the end of January, will include a couple of major changes that are bound to shake up the internet. The first, most disruptive change will involve labeling unencrypted websites as \u201cNot Secure.\u201d<\/strong> The other update marks the final deprecation of SHA-1.<\/p>\n

Both will have major ramifications. Let\u2019s take a look at each.<\/p>\n

Non-HTTPS sites Will be Labeled \u201cNot Secure\u201d<\/h3>\n

In Chrome 55, Google changed the security indicator for an encrypted connection to \u201cSecure.\u201d That\u2019s right, the address bar now says \u201cSecure\u201d in green next to a padlock icon and the URL when you\u2019re on a site with SSL.<\/p>\n

\"chrome<\/p>\n

That was the first stage. In Chrome 56, Google will change its negative security indicators to say \u201cNot Secure\u201d anytime you visit a non-HTTPS site. Here\u2019s what it will look like:<\/p>\n

\"Not<\/p>\n

As you can probably imagine, this is going to be an issue for a lot of website owners. According to Symantec, as of last year, just 3-5% of all websites were encrypted. That means that with the arrival of Google Chrome 56, upwards of 95% of the internet could see that Google is labeling their website as \u201cNot Secure.\u201d<\/p>\n

In a day and age where the internet-using public is hyper-vigilant about threats to its privacy and safety, a \u201cNot Secure\u201d visual indicator is going to absolutely crater traffic for a lot of sites. It\u2019s also going to affect a lot of business\u2019 bottom lines.<\/p>\n

The end result is that SSL certificates are going to become a requirement for most websites. Frankly, it\u2019s going to change the entire SSL industry, as more web hosts become interested in offering encryption solutions, more customers enter the marketplace and more people learn about the product.<\/p>\n

The End of SHA-1 Encryption<\/h3>\n

If you\u2019re not in IT or tasked with handling your company or organization\u2019s security implementations, then you likely haven\u2019t followed the fact that the internet has been deprecating SHA-1 encryption while we migrate to SHA-2.<\/p>\n

SHA-1 and SHA-2 are hashing algorithms, they\u2019re used to achieve a number of functions and are extremely important in the context of SSL. Since the beginning of 2016 issuing certificates with SHA-1 encryption was pretty much banned. Now in 2017, with the release of Chrome 56, support for SHA-1 encryption will be pulled.<\/p>\n

Basically, if you want to buy an SSL Certificate from now on, you need to use SHA-2 encryption. SHA-1 certificates will now be greeted with a full page warning. The other browsers, Mozilla Firefox, Apple Safari and Microsoft Edge, have all announced plans to follow suit. SHA-1 is officially dead as of the release of Chrome 56.<\/p>\n

If your website still uses an SHA-1 certificate, you have several options. If there\u2019s still time left on it, more than three months \u2013 you can usually re-issue the certificate, this time selecting the SHA-2 option, and then re-install it on your server. This will instantly solve your problems. If you have three months or less, you can renew and select SHA-2 encryption. This lets you carry over any remaining time and maintain browser support. Or, if those two fail, you might just have to purchase a new one.<\/p>\n

Either way, come the release of Google Chrome 56, SHA-1 encryption will no longer cut it.<\/p>\n

Wrapping Up<\/h3>\n

As you can see, the release of Chrome 56 means big changes for SSL and the internet, it also represents a big step forward for internet security. Encryption is a good thing, nobody should be able to eavesdrop on a connection. Making SSL a requirement will go a long way towards protecting people\u2019s privacy.<\/p>\n

But these changes alone are only a piece of a much larger puzzle. Google\u2019s new \u201cSecure\u201d indicator could end up doing more harm than good as it lulls people into a false sense of security and access to free DV SSL will make it even easier for cybercriminals to phish us.<\/p>\n

The next battle will be about authentication, the ability to verify your online identity. But for now, it\u2019s enough to be happy that encryption \u2013 and by extension, a safer internet is coming.<\/p>\n

Important Guides to Read<\/h3>\n