Endpoint

8/3/2017
05:45 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Symantec Sells Digital Certificate Business to DigiCert

$950 million deal comes in the wake of Google sanctions on Symantec certs earlier this year.

Symantec will sell its SSL business to DigiCert for $950 million in a move that lets the security vendor avoid the need to entirely rebuild its digital certificate issuance infrastructure following a series of punitive actions by Google earlier this year.

Under terms of the sale announced this week, in addition to the upfront cash, Symantec will also receive a 30% stake in the common stock of DigiCert.

In a prepared statement, Symantec CEO Greg Clark said the proposed sale would sharpen the company's focus on cloud security. Symantec customers meanwhile will benefit from having a company that offers a modern website PKI platform to handle their digital certificate requirements going forward, he said.

Symantec's board has approved the transaction, which is expected to formally close in the third quarter of fiscal 2018.

The proposed sale makes sense for Symantec and is consistent with the general direction in which the company has been heading recently, says Garrett Bekker, principal security analyst at 451 Research.

"Symantec has spent about $7.5 billion on acquisitions since they got rid of Veritas," and began to focus purely on the cybersecurity market, he says. "They are certainly trying to rationalize their portfolio and get rid of non-core assets."

The plan especially makes sense for Symantec considering the pressure it has been under from Google in recent months, Bekker says.

He was referring to a Google decision from earlier this year to gradually deprecate all Symantec issued digital certificates over the next several months. Google described the decision as being driven by multiple failures on Symantec's part to properly validate its digital certificates before issuance.

Google said that an investigation it conducted showed that Symantec had allowed at least four parties to access its infrastructure and issue certificates with none of the required checks and balances. Google claimed that an inquiry that began with a set of 127 Symantec issued certificates expanded to over 30,000 suspect certificates over multiple years.

Symantec's failure to properly oversee the issuance of these certificates represented a failure by the company to adhere to the standards expected of a Certificate Authority and posed a threat to Google Chrome users, Google claimed. As a result, Chrome would, in a phased manner stop trusting all existing Symantec-issued certificates Google said. Going forward, Symantec would need to replace the certificates with new fully validated ones, Google had said.

Symantec itself characterized Google's claims and misleading and grossly exaggerated. The company claimed that only 127 certificates were identified as mis-issued and not 30,000. Symantec said that Google was singling it out for blame though the mis-issuance involved multiple CAs.

Selling off the certificate business means that Symantec no longer will need to contend with the issue. But "questions about how the certificate infrastructure will evolve if the merger goes through should be uppermost in the minds of customers and partners," says Michael Fowler, president of DigiCert rival Comodo CA. What still remains to be determined for Symantec customers is how the sale will impact Google's decision to deprecate all existing Symantec SSL certificates starting October 2018, he says.

Given the problems that Google has identified with Symantec's infrastructure it is unlikely that DigiCert will use it going forward, Fowler speculates. But DigiCert, as a smaller vendor in this space, does not have the same infrastructure as Symantec, which could be problematic for Symantec's enterprise customers and channel partners, he claims.

Bekker though sees little to no complication for Symantec's customers. "I don't think [the proposed sale] will have much of an impact at all," he says.

Symantec's certificate business will immediately increase DigiCert's market share and make the company one of the biggest players in the PKI and SSL markets, Bekker says. "This will make DigiCert pretty much one of the leaders in terms of revenues," in the digital certificate business.

Related content

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
White House Cybersecurity Strategy at a Crossroads
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/17/2018
Mueller Probe Yields Hacking Indictments for 12 Russian Military Officers
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/13/2018
10 Ways to Protect Protocols That Aren't DNS
Curtis Franklin Jr., Senior Editor at Dark Reading,  7/16/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2016-10727
PUBLISHED: 2018-07-20
camel/providers/imapx/camel-imapx-server.c in the IMAPx component in GNOME evolution-data-server before 3.21.2 proceeds with cleartext data containing a password if the client wishes to use STARTTLS but the server will not use STARTTLS, which makes it easier for remote attackers to obtain sensitive ...
CVE-2018-8018
PUBLISHED: 2018-07-20
Apache Ignite 2.5 and earlier serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulnerability can be exploited if the one sends a spe...
CVE-2018-14415
PUBLISHED: 2018-07-20
An issue was discovered in idreamsoft iCMS before 7.0.10. XSS exists via the fourth and fifth input elements on the admincp.php?app=prop&do=add screen.
CVE-2018-14418
PUBLISHED: 2018-07-20
In Msvod Cms v10, SQL Injection exists via an images/lists?cid= URI.
CVE-2018-14419
PUBLISHED: 2018-07-20
MetInfo 6.0.0 allows XSS via a modified name of the navigation bar on the home page.