Google will upgrade all its SSL certificates to 2048-bit keys by the end of 2013, the company has announced.
Google will begin moving to the stronger certificates from 1 August and will also change its root certificate — used to sign all its SSL certificates — which currently has a 1024-bit key.
The upgrade is expected to make it difficult to forge the upgrade certificates and make users more confident.
Announcing the news in a blog post, Google’s director of information security engineering Stephen McHenry said it will begin switching to the new 2048-bit certificates on 1 August to ensure adequate time for a careful rollout before the end of the year.
“We’re also going to change the root certificate that signs all of our SSL certificates because it has a 1024-bit key,” McHenry said.
“Most client software won’t have any problems with either of these changes, but we know that some configurations will require some extra steps to avoid complications. This is more often true of client software embedded in devices such as certain types of phones, printers, set-top boxes, gaming consoles, and cameras.”
McHenry advised that for a smooth upgrade, client software that makes SSL connections to Google, for example, HTTPS must “perform normal validation of the certificate chain; include a properly extensive set of root certificates contained…and support Subject Alternative Names (SANs)”.
He also recommended that clients support the Server Name Indication (SNI) extension because they might need to make an extra API call to set the hostname on an SSL connection.
