17
Jul
2024
Import and export Markdown in Google Docs
What’s changingIn 2022, we introduced expanded support for composing with Markdown in Google Docs on web. Today, we’re introducing highly-requested features that enhance Docs' interoperability with other Markdown supporting tools. These include the abi...
16
Jul
2024
Upcoming changes to page size in the Google Ads API
Starting the week of August 19, 2024, we will roll out a change that removes the ability to set the page_size field when making GoogleAdsService.Search requests. All requests will assume a fixed page size of 10,000 rows instead. Developers will rece...
16
Jul
2024
How we built AlphaFold 3 to predict the structure and interaction of all of life’s molecules
Here’s how this model came to be.
16
Jul
2024
Google Workspace extensions for Gmail, Google Drive and Google Docs are now available in open beta for Gemini (gemini.google.com)
What’s changing We’re pleased to announce Google Workspace extensions for Gmail, Google Drive and Google Docs are available for Gemini (gemini.google.com). When enabled, Gemini will be able to cross reference these apps as data sources to better i...
16
Jul
2024
Teachers will soon be able to create a new class in Google Classroom using Student Information System (SIS) data
What’s changingWe recently introduced the ability to import data, such as student rosters, co-teachers and grading categories, from your Student Information System (SIS) to Google Classroom. In the coming weeks, we will be introducing a new featur...
16
Jul
2024
Google Classroom now supports exporting grades and importing rosters and grade settings with PowerSchool SIS
What’s changingGoogle Classroom teachers can now export and import select information via the new integration with PowerSchool SIS, a third-party student information system (SIS) that provides innovative K-12 software and cloud-based solutions to impr...
15
Jul
2024
3 fun Gemma project ideas
Use Gemma models to translate an old language, brainstorm game design ideas, and write a letter to Santa.
14
Jul
2024
Get started with Gemma on Ray on Vertex AI
Use Gemma Supervised tuning on Ray on Vertex AI to train and serve machine learning models efficiently and effectively.
14
Jul
2024
Enabling more private generative AI
Google has developed a number of technologies that you can use to start experimenting with and exploring the potential of generative AI to process data that needs to stay private.
14
Jul
2024
Google Workspace Updates Weekly Recap – July 12, 2024
2 New updatesUnless otherwise indicated, the features below are available to all Google Workspace customers, and are fully launched or in the process of rolling out. Rollouts should take no more than 15 business days to complete if launching to both&nb...
12
Jul
2024
Prepare your app for the new Samsung Galaxy foldables and watches!
Posted by Maru Ahues Bouza – Product Management Director, Android Developer
Yesterday’s Galaxy Unpacked event from Samsung debuted the latest in foldables, wearables, and more! The event introduced the Galaxy Z Fold6 and Z Flip6 and the Galaxy W...
11
Jul
2024
10 years ago, Android expanded to 3 new platforms
Learn more about why 2014 was a big year for Android.
11
Jul
2024
Access Google Meet artifacts with a new Google Drive API scope
What’s changing We’re introducing a new OAuth scope for the Drive API: drive.meet.readonly. The new scope grants app access to read and download files from a user’s drive that were created or edited by Google Meet — this includes meeting transcrip...
11
Jul
2024
Reminder: Entity Read Files sunset on October 31, 2024
On October 31, 2024, Display & Video 360 Entity Read Files (ERFs) will sunset. After this date, new private and public ERFs will not be generated. ERFs were deprecated in June 2021 and the October sunset date was first announced in January 2024.
If...
11
Jul
2024
Configure your shipping and returns directly in Search Console
This post discusses a new and easier way to add shipping or return information directly in Search Console.
11
Jul
2024
Reduce ANRs when implementing mobile ads
We heard your feedback via Play Console crash reports regarding Application Not Responding (ANRs) errors related to the Google Mobile Ads SDK. After analyzing these reports, we updated our SDK implementation best practices to reduce ANR rates. The rec...
10
Jul
2024
Rollout Update: setting the default camera framing option for Google Meet hardware devices
What’s changing We recently announced several updates related to framing options on Google Hardware devices. This included the ability for admins to configure the default camera framing option for their hardware devices. After pausing rollout to o...
10
Jul
2024
Discover Mongolia’s heritage and traditions on Google Arts & Culture
Discover Mongolia’s culture and heritage on Google Arts & Culture.
10
Jul
2024
Health partners can now more easily access Fitbit heart data
Fitbit's Irregular Rhythm Notification feature is now available via Web API to healthcare providers with user permission.
10
Jul
2024
Register for the Performance Max Workshop
As previously announced, the Performance Max and the Google Ads API workshop is only one week away, on July 17, 2024. Register today to reserve your spot.
As a reminder, this developer-focused, virtual workshop will provide you with knowledge, reso...
10
Jul
2024
4 Google updates coming to Samsung devices
New Circle to Search capabilities, Wear OS 5 and more are coming to Samsung’s latest devices.
10
Jul
2024
Passkeys are now available for high risk users to enroll in the Advanced Protection Program
Starting today, high risk users can use passkeys to enroll in the Advanced Protection Program.
10
Jul
2024
Google Meet and Zoom interoperability now includes presented content via a wired HDMI connection
What’s changing We’re expanding the interoperability between Google Meet and Zoom to include the ability to present content via a wired HDMI connection. This functionality will allow you: Present HDMI content into your Zoom Meetings from Goog...
9
Jul
2024
Use the Apple Volume Purchasing Program (VPP) to distribute apps for device enrollment and company owned devices
What’s changingIn November 2023, we announced the ability to purchase and distribute iOS apps to user-enrolled devices through Apple’s Volume Purchase Program. Beginning today, we’re expanding this functionality to include device enrollment and company...
9
Jul
2024
Pre-configure meeting notes, recordings, and transcripts from the Calendar invite
What’s changing Meeting hosts can now pre-configure meeting notes, meeting recordings, and meeting transcripts from the Calendar invite. This helps ensure that these specific artifacts are automatically captured, reducing the need for the meeting ...
9
Jul
2024
Enhancing the Google Calendar appointment scheduling experience with additional features
What’s changingFollowing our recent announcement of the appointment slots feature in Google Calendar being replaced by appointment schedules in July 2024, we’re updating appointment schedules by adding new features to enhance the overall experience.&nb...
9
Jul
2024
Empowering Black Founders through Google’s Accelerators
Meet this year’s Google for Startups Accelerator: Black Founders cohort
9
Jul
2024
UNESCO’s Treasures of the Ancient Silk Roads
The possibility to virtually explore the fantastic collection of marbles and sculpture from the Acropolis Museum on Google Arts & Culture
9
Jul
2024
Manage your compliance and data controls from a single source in the Admin console
What’s changing We know that compliance and data controls are paramount for our customers, both in understanding Google Workspace’s policies and configuring compliance-relevant features according to the needs of their business sector and geographi...
8
Jul
2024
Access Management is now generally available in the European Union
What’s changing Access Management is now also generally available in the European Union — these controls allow customers to select the physical location from which Google support teams can access organizational data during support activities. Cust...
8
Jul
2024
Mouse brain research is helping us better understand human minds
Researchers on our Connectomics team have completed the largest ever AI-assisted digital reconstruction of human brain tissue. Here’s why they’re taking on the mouse bra…
8
Jul
2024
Introducing a new experience for data regions reporting
What’s changing We’re pleased to announce several new enhancements to Google Workspace data regions: For the first time, admins will be able to specify not only the region (EU or US) where their data is stored, but also the region in which it...
8
Jul
2024
Exclusive experience at Pokémon GO Fest 2024 for Google Play Points members
Google Play Points members can catch exclusive perks and prizes at this year’s Pokémon GO Fest 2024.
5
Jul
2024
The world’s oldest known evidence of storytelling through art
For the first time, take a virtual journey to the world’s oldest known painted picture, recently discovered in a cave in Sulawesi, Indonesia.
4
Jul
2024
Location Auto-migration Complete
What changed?
On 24 July 2023, we announced the auto-migration of location extensions to assets. For the majority of accounts, location extensions were automatically migrated to assets. This change was made to expand the variety of ways in which your l...
On 24 July 2023, we announced the auto-migration of location extensions to assets. For the majority of accounts, location extensions were automatically migrated to assets. This change was made to expand the variety of ways in which your l...
3
Jul
2024
Important policy updates for Early Access apps starting July 30, 2024
What’s changing To ensure organizations’ continued access to services, we're changing the way Early Access apps transition to Additional Google Services:Currently, when an Early Access app becomes an Additional Google Service, it is turned on or o...
2
Jul
2024
Adding a ‘missing’ grade state to Gradebook in Google Classroom
What’s changing In the last year, we’ve added new features, such as disabling submissions after a due date in Google Classroom and excusing assignments in Google Classroom, in order to give teachers even more flexibility when it comes to grading f...
2
Jul
2024
6 ways AI makes your Pixel even more helpful
Try these AI features to get the most out of your Pixel.
2
Jul
2024
Our 2024 Environmental Report
Our 2024 Environmental Report looks at our use of technology to drive environmental change and operate our business sustainably.
2
Jul
2024
Announcing the Merchant API Beta, the new version of the Content API for Shopping
Today we're announcing the release of the Merchant API Beta. This is the newest version of the Content API for Shopping which comes with exciting new features. The Merchant API is a redesign of the Content API for Shopping which can help you showcase y...
2
Jul
2024
Meet the students that are changing the world through technology
Meet the winners of this year’s Google for Developers Solution Challenge.
1
Jul
2024
Our investment to accelerate clean energy in Asia Pacific
We’re partnering with BlackRock to support a pipeline of new solar projects in Taiwan.
1
Jul
2024
Fine-tuning Gemma 2 with Keras – and an update from Hugging Face
The next generation of Gemma models is now available in KerasNLP.
29
Jun
2024
Gemini 1.5 Pro 2M context window, code execution capabilities, and Gemma 2 are available today
Developers will now be able to give Gemini 1.5 Flash a set of pre-trained data of their own and tune it to improve model performance significantly.
29
Jun
2024
Model Explorer: Simplifying ML models for Edge devices
Model Explorer, a new graph visualization tool from Google AI Edge, enables developers to overcome the complexities of optimizing models for edge devices.
29
Jun
2024
How We Built It: The I/O Crossword
Adding a helpful twist to a classic crossword puzzle with the power of Flutter, Firebase, and the Gemini API.
29
Jun
2024
Bringing the I/O magic to Berlin
Here are some highlights from what we announced both on stage in Berlin and elsewhere in the world in celebration of this event!
29
Jun
2024
Google Workspace Updates Weekly Recap – June 28, 2024
3 New updatesUnless otherwise indicated, the features below are available to all Google Workspace customers, and are fully launched or in the process of rolling out. Rollouts should take no more than 15 business days to complete if launching to both&nb...
28
Jun
2024
#WeArePlay | 4 stories of founders building apps for the LGBTQIA+ community
Posted by Robbie McLachlan, Developer Marketing
#WeArePlay celebrates the inspiring journeys of people behind apps and games on Google Play. In honor of Pride Month, we are highlighting founders who have built tools to empower the LGBTQIA+ commun...
28
Jun
2024
Sustaining Digital Certificate Security – Entrust Certificate Distrust
Posted by Chrome Root Program, Chrome Security Team
Update (07/22/2024): Website operators who will be impacted by the upcoming change in Chrome for new TLS certificates issued after October 31, 2024 can explore continuity options offered by Entrust. Entrust has expressed its commitment to continuing to support customer needs, and is best positioned to describe the available options for website operators. Learn more at Entrust’s TLS Certificate Information Center.
The Chrome Security Team prioritizes the security and privacy of Chrome’s users, and we are unwilling to compromise on these values.
The Chrome Root Program Policy states that CA certificates included in the Chrome Root Store must provide value to Chrome end users that exceeds the risk of their continued inclusion. It also describes many of the factors we consider significant when CA Owners disclose and respond to incidents. When things don’t go right, we expect CA Owners to commit to meaningful and demonstrable change resulting in evidenced continuous improvement.
Over the past several years, publicly disclosed incident reports highlighted a pattern of concerning behaviors by Entrust that fall short of the above expectations, and has eroded confidence in their competence, reliability, and integrity as a publicly-trusted CA Owner.
In response to the above concerns and to preserve the integrity of the Web PKI ecosystem, Chrome will take the following actions.
Upcoming change in Chrome 127 and higher:
TLS server authentication certificates validating to the following Entrust roots whose earliest Signed Certificate Timestamp (SCT) is dated after October 31, 2024, will no longer be trusted by default.
CN=Entrust Root Certification Authority - EC1,OU=See www.entrust.net/legal-terms+OU=(c) 2012 Entrust, Inc. - for authorized use only,O=Entrust, Inc.,C=US
CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust, Inc. - for authorized use only,O=Entrust, Inc.,C=US
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
CN=Entrust Root Certification Authority,OU=www.entrust.net/CPS is incorporated by reference+OU=(c) 2006 Entrust, Inc.,O=Entrust, Inc.,C=US
CN=Entrust Root Certification Authority - G4,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust, Inc. - for authorized use only,O=Entrust, Inc.,C=US
CN=AffirmTrust Commercial,O=AffirmTrust,C=US
CN=AffirmTrust Networking,O=AffirmTrust,C=US
CN=AffirmTrust Premium,O=AffirmTrust,C=US
CN=AffirmTrust Premium ECC,O=AffirmTrust,C=US
TLS server authentication certificates validating to the above set of roots whose earliest SCT is on or before October 31, 2024, will be unaffected by this change.This approach attempts to minimize disruption to existing subscribers using a recently announced Chrome feature to remove default trust based on the SCTs in certificates.
Additionally, should a Chrome user or enterprise explicitly trust any of the above certificates on a platform and version of Chrome relying on the Chrome Root Store (e.g., explicit trust is conveyed through a Group Policy Object on Windows), the SCT-based constraints described above will be overridden and certificates will function as they do today.
To further minimize risk of disruption, website operators are encouraged to review the “Frequently Asked Questions" listed below.
Why is Chrome taking action?
Certification Authorities (CAs) serve a privileged and trusted role on the Internet that underpin encrypted connections between browsers and websites. With this tremendous responsibility comes an expectation of adhering to reasonable and consensus-driven security and compliance expectations, including those defined by the CA/Browser TLS Baseline Requirements.
Over the past six years, we have observed a pattern of compliance failures, unmet improvement commitments, and the absence of tangible, measurable progress in response to publicly disclosed incident reports. When these factors are considered in aggregate and considered against the inherent risk each publicly-trusted CA poses to the Internet ecosystem, it is our opinion that Chrome’s continued trust in Entrust is no longer justified.
When will this action happen?
Blocking action will begin on approximately November 1, 2024, affecting certificates issued at that point or later.
Blocking action will occur in Versions of Chrome 127 and greater on Windows, macOS, ChromeOS, Android, and Linux. Apple policies prevent the Chrome Certificate Verifier and corresponding Chrome Root Store from being used on Chrome for iOS.
What is the user impact of this action?
By default, Chrome users in the above populations who navigate to a website serving a certificate issued by Entrust or AffirmTrust after October 31, 2024 will see a full page interstitial similar to this one.
Certificates issued by other CAs are not impacted by this action.
How can a website operator tell if their website is affected?
Website operators can determine if they are affected by this issue by using the Chrome Certificate Viewer.
Use the Chrome Certificate Viewer
Navigate to a website (e.g., https://www.google.com)
Click the “Tune" icon
Click “Connection is Secure"
Click “Certificate is Valid" (the Chrome Certificate Viewer will open)
Website owner action is not required, if the “Organization (O)” field listed beneath the “Issued By" heading does not contain “Entrust" or “AffirmTrust”.
Website owner action is required, if the “Organization (O)” field listed beneath the “Issued By" heading contains “Entrust" or “AffirmTrust”.
What does an affected website operator do?
We recommend that affected website operators transition to a new publicly-trusted CA Owner as soon as reasonably possible. To avoid adverse website user impact, action must be completed before the existing certificate(s) expire if expiry is planned to take place after October 31, 2024.
While website operators could delay the impact of blocking action by choosing to collect and install a new TLS certificate issued from Entrust before Chrome’s blocking action begins on November 1, 2024, website operators will inevitably need to collect and install a new TLS certificate from one of the many other CAs included in the Chrome Root Store.
Can I test these changes before they take effect?
Yes.
A command-line flag was added beginning in Chrome 128 (available in Canary/Dev at the time of this post’s publication) that allows administrators and power users to simulate the effect of an SCTNotAfter distrust constraint as described in this blog post FAQ.
How to: Simulate an SCTNotAfter distrust1. Close all open versions of Chrome2. Start Chrome using the following command-line flag, substituting variables described below with actual values
--test-crs-constraints=$[Comma Separated List of Trust Anchor Certificate SHA256 Hashes]:sctnotafter=$[epoch_timestamp]
3. Evaluate the effects of the flag with test websites Example: The following command will simulate an SCTNotAfter distrust with an effective date of April 30, 2024 11:59:59 PM GMT for all of the Entrust trust anchors included in the Chrome Root Store. The expected behavior is that any website whose certificate is issued before the enforcement date/timestamp will function in Chrome, and all issued after will display an interstitial.
--test-crs-constraints=02ED0EB28C14DA45165C566791700D6451D7FB56F0B2AB1D3B8EB070E56EDFF5,
43DF5774B03E7FEF5FE40D931A7BEDF1BB2E6B42738C4E6D3841103D3AA7F339,
6DC47172E01CBCB0BF62580D895FE2B8AC9AD4F873801E0C10B9C837D21EB177,
73C176434F1BC6D5ADF45B0E76E727287C8DE57616C1E6E6141A2B2CBC7D8E4C,
DB3517D1F6732A2D5AB97C533EC70779EE3270A62FB4AC4238372460E6F01E88,
0376AB1D54C5F9803CE4B2E201A0EE7EEF7B57B636E8A93C9B8D4860C96F5FA7,
0A81EC5A929777F145904AF38D5D509F66B5E2C58FCDB531058B0E17F3F0B41B,
70A73F7F376B60074248904534B11482D5BF0E698ECC498DF52577EBF2E93B9A,
BD71FDF6DA97E4CF62D1647ADD2581B07D79ADF8397EB4ECBA9C5E8488821423
:sctnotafter=1714521599
Illustrative Command (on Windows):
"C:\Users\User123\AppData\Local\Google\Chrome SxS\Application\chrome.exe" --test-crs-constraints=02ED0EB28C14DA45165C566791700D6451D7FB56F0B2AB1D3B8EB070E56EDFF5,43DF5774B03E7FEF5FE40D931A7BEDF1BB2E6B42738C4E6D3841103D3AA7F339,6DC47172E01CBCB0BF62580D895FE2B8AC9AD4F873801E0C10B9C837D21EB177,73C176434F1BC6D5ADF45B0E76E727287C8DE57616C1E6E6141A2B2CBC7D8E4C,DB3517D1F6732A2D5AB97C533EC70779EE3270A62FB4AC4238372460E6F01E88,0376AB1D54C5F9803CE4B2E201A0EE7EEF7B57B636E8A93C9B8D4860C96F5FA7,0A81EC5A929777F145904AF38D5D509F66B5E2C58FCDB531058B0E17F3F0B41B,70A73F7F376B60074248904534B11482D5BF0E698ECC498DF52577EBF2E93B9A,BD71FDF6DA97E4CF62D1647ADD2581B07D79ADF8397EB4ECBA9C5E8488821423:sctnotafter=1714521599
Illustrative Command (on macOS):
"/Applications/Google Chrome Canary.app/Contents/MacOS/Google Chrome Canary" --test-crs-constraints=02ED0EB28C14DA45165C566791700D6451D7FB56F0B2AB1D3B8EB070E56EDFF5,43DF5774B03E7FEF5FE40D931A7BEDF1BB2E6B42738C4E6D3841103D3AA7F339,6DC47172E01CBCB0BF62580D895FE2B8AC9AD4F873801E0C10B9C837D21EB177,73C176434F1BC6D5ADF45B0E76E727287C8DE57616C1E6E6141A2B2CBC7D8E4C,DB3517D1F6732A2D5AB97C533EC70779EE3270A62FB4AC4238372460E6F01E88,0376AB1D54C5F9803CE4B2E201A0EE7EEF7B57B636E8A93C9B8D4860C96F5FA7,0A81EC5A929777F145904AF38D5D509F66B5E2C58FCDB531058B0E17F3F0B41B,70A73F7F376B60074248904534B11482D5BF0E698ECC498DF52577EBF2E93B9A,BD71FDF6DA97E4CF62D1647ADD2581B07D79ADF8397EB4ECBA9C5E8488821423:sctnotafter=1714521599
Note: If copy and pasting the above commands, ensure no line-breaks are introduced.
Learn more about command-line flags here.
I use Entrust certificates for my internal enterprise network, do I need to do anything?
Beginning in Chrome 127, enterprises can override Chrome Root Store constraints like those described for Entrust in this blog post by installing the corresponding root CA certificate as a locally-trusted root on the platform Chrome is running (e.g., installed in the Microsoft Certificate Store as a Trusted Root CA).
How do enterprises add a CA as locally-trusted?
Customer organizations should defer to platform provider guidance.
What about other Google products?
Other Google product team updates may be made available in the future.
Update (07/22/2024): Website operators who will be impacted by the upcoming change in Chrome for new TLS certificates issued after October 31, 2024 can explore continuity options offered by Entrust. Entrust has expressed its commitment to continuing to support customer needs, and is best positioned to describe the available options for website operators. Learn more at Entrust’s TLS Certificate Information Center.
The Chrome Security Team prioritizes the security and privacy of Chrome’s users, and we are unwilling to compromise on these values.
The Chrome Root Program Policy states that CA certificates included in the Chrome Root Store must provide value to Chrome end users that exceeds the risk of their continued inclusion. It also describes many of the factors we consider significant when CA Owners disclose and respond to incidents. When things don’t go right, we expect CA Owners to commit to meaningful and demonstrable change resulting in evidenced continuous improvement.
Over the past several years, publicly disclosed incident reports highlighted a pattern of concerning behaviors by Entrust that fall short of the above expectations, and has eroded confidence in their competence, reliability, and integrity as a publicly-trusted CA Owner.
In response to the above concerns and to preserve the integrity of the Web PKI ecosystem, Chrome will take the following actions.
Upcoming change in Chrome 127 and higher:
TLS server authentication certificates validating to the following Entrust roots whose earliest Signed Certificate Timestamp (SCT) is dated after October 31, 2024, will no longer be trusted by default.
CN=Entrust Root Certification Authority - EC1,OU=See www.entrust.net/legal-terms+OU=(c) 2012 Entrust, Inc. - for authorized use only,O=Entrust, Inc.,C=US
CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust, Inc. - for authorized use only,O=Entrust, Inc.,C=US
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
CN=Entrust Root Certification Authority,OU=www.entrust.net/CPS is incorporated by reference+OU=(c) 2006 Entrust, Inc.,O=Entrust, Inc.,C=US
CN=Entrust Root Certification Authority - G4,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust, Inc. - for authorized use only,O=Entrust, Inc.,C=US
CN=AffirmTrust Commercial,O=AffirmTrust,C=US
CN=AffirmTrust Networking,O=AffirmTrust,C=US
CN=AffirmTrust Premium,O=AffirmTrust,C=US
CN=AffirmTrust Premium ECC,O=AffirmTrust,C=US
TLS server authentication certificates validating to the above set of roots whose earliest SCT is on or before October 31, 2024, will be unaffected by this change.This approach attempts to minimize disruption to existing subscribers using a recently announced Chrome feature to remove default trust based on the SCTs in certificates.
Additionally, should a Chrome user or enterprise explicitly trust any of the above certificates on a platform and version of Chrome relying on the Chrome Root Store (e.g., explicit trust is conveyed through a Group Policy Object on Windows), the SCT-based constraints described above will be overridden and certificates will function as they do today.
To further minimize risk of disruption, website operators are encouraged to review the “Frequently Asked Questions" listed below.
Why is Chrome taking action?
Certification Authorities (CAs) serve a privileged and trusted role on the Internet that underpin encrypted connections between browsers and websites. With this tremendous responsibility comes an expectation of adhering to reasonable and consensus-driven security and compliance expectations, including those defined by the CA/Browser TLS Baseline Requirements.
Over the past six years, we have observed a pattern of compliance failures, unmet improvement commitments, and the absence of tangible, measurable progress in response to publicly disclosed incident reports. When these factors are considered in aggregate and considered against the inherent risk each publicly-trusted CA poses to the Internet ecosystem, it is our opinion that Chrome’s continued trust in Entrust is no longer justified.
When will this action happen?
Blocking action will begin on approximately November 1, 2024, affecting certificates issued at that point or later.
Blocking action will occur in Versions of Chrome 127 and greater on Windows, macOS, ChromeOS, Android, and Linux. Apple policies prevent the Chrome Certificate Verifier and corresponding Chrome Root Store from being used on Chrome for iOS.
What is the user impact of this action?
By default, Chrome users in the above populations who navigate to a website serving a certificate issued by Entrust or AffirmTrust after October 31, 2024 will see a full page interstitial similar to this one.
Certificates issued by other CAs are not impacted by this action.
How can a website operator tell if their website is affected?
Website operators can determine if they are affected by this issue by using the Chrome Certificate Viewer.
Use the Chrome Certificate Viewer
Navigate to a website (e.g., https://www.google.com)
Click the “Tune" icon
Click “Connection is Secure"
Click “Certificate is Valid" (the Chrome Certificate Viewer will open)
Website owner action is not required, if the “Organization (O)” field listed beneath the “Issued By" heading does not contain “Entrust" or “AffirmTrust”.
Website owner action is required, if the “Organization (O)” field listed beneath the “Issued By" heading contains “Entrust" or “AffirmTrust”.
What does an affected website operator do?
We recommend that affected website operators transition to a new publicly-trusted CA Owner as soon as reasonably possible. To avoid adverse website user impact, action must be completed before the existing certificate(s) expire if expiry is planned to take place after October 31, 2024.
While website operators could delay the impact of blocking action by choosing to collect and install a new TLS certificate issued from Entrust before Chrome’s blocking action begins on November 1, 2024, website operators will inevitably need to collect and install a new TLS certificate from one of the many other CAs included in the Chrome Root Store.
Can I test these changes before they take effect?
Yes.
A command-line flag was added beginning in Chrome 128 (available in Canary/Dev at the time of this post’s publication) that allows administrators and power users to simulate the effect of an SCTNotAfter distrust constraint as described in this blog post FAQ.
How to: Simulate an SCTNotAfter distrust1. Close all open versions of Chrome2. Start Chrome using the following command-line flag, substituting variables described below with actual values
--test-crs-constraints=$[Comma Separated List of Trust Anchor Certificate SHA256 Hashes]:sctnotafter=$[epoch_timestamp]
3. Evaluate the effects of the flag with test websites Example: The following command will simulate an SCTNotAfter distrust with an effective date of April 30, 2024 11:59:59 PM GMT for all of the Entrust trust anchors included in the Chrome Root Store. The expected behavior is that any website whose certificate is issued before the enforcement date/timestamp will function in Chrome, and all issued after will display an interstitial.
--test-crs-constraints=02ED0EB28C14DA45165C566791700D6451D7FB56F0B2AB1D3B8EB070E56EDFF5,
43DF5774B03E7FEF5FE40D931A7BEDF1BB2E6B42738C4E6D3841103D3AA7F339,
6DC47172E01CBCB0BF62580D895FE2B8AC9AD4F873801E0C10B9C837D21EB177,
73C176434F1BC6D5ADF45B0E76E727287C8DE57616C1E6E6141A2B2CBC7D8E4C,
DB3517D1F6732A2D5AB97C533EC70779EE3270A62FB4AC4238372460E6F01E88,
0376AB1D54C5F9803CE4B2E201A0EE7EEF7B57B636E8A93C9B8D4860C96F5FA7,
0A81EC5A929777F145904AF38D5D509F66B5E2C58FCDB531058B0E17F3F0B41B,
70A73F7F376B60074248904534B11482D5BF0E698ECC498DF52577EBF2E93B9A,
BD71FDF6DA97E4CF62D1647ADD2581B07D79ADF8397EB4ECBA9C5E8488821423
:sctnotafter=1714521599
Illustrative Command (on Windows):
"C:\Users\User123\AppData\Local\Google\Chrome SxS\Application\chrome.exe" --test-crs-constraints=02ED0EB28C14DA45165C566791700D6451D7FB56F0B2AB1D3B8EB070E56EDFF5,43DF5774B03E7FEF5FE40D931A7BEDF1BB2E6B42738C4E6D3841103D3AA7F339,6DC47172E01CBCB0BF62580D895FE2B8AC9AD4F873801E0C10B9C837D21EB177,73C176434F1BC6D5ADF45B0E76E727287C8DE57616C1E6E6141A2B2CBC7D8E4C,DB3517D1F6732A2D5AB97C533EC70779EE3270A62FB4AC4238372460E6F01E88,0376AB1D54C5F9803CE4B2E201A0EE7EEF7B57B636E8A93C9B8D4860C96F5FA7,0A81EC5A929777F145904AF38D5D509F66B5E2C58FCDB531058B0E17F3F0B41B,70A73F7F376B60074248904534B11482D5BF0E698ECC498DF52577EBF2E93B9A,BD71FDF6DA97E4CF62D1647ADD2581B07D79ADF8397EB4ECBA9C5E8488821423:sctnotafter=1714521599
Illustrative Command (on macOS):
"/Applications/Google Chrome Canary.app/Contents/MacOS/Google Chrome Canary" --test-crs-constraints=02ED0EB28C14DA45165C566791700D6451D7FB56F0B2AB1D3B8EB070E56EDFF5,43DF5774B03E7FEF5FE40D931A7BEDF1BB2E6B42738C4E6D3841103D3AA7F339,6DC47172E01CBCB0BF62580D895FE2B8AC9AD4F873801E0C10B9C837D21EB177,73C176434F1BC6D5ADF45B0E76E727287C8DE57616C1E6E6141A2B2CBC7D8E4C,DB3517D1F6732A2D5AB97C533EC70779EE3270A62FB4AC4238372460E6F01E88,0376AB1D54C5F9803CE4B2E201A0EE7EEF7B57B636E8A93C9B8D4860C96F5FA7,0A81EC5A929777F145904AF38D5D509F66B5E2C58FCDB531058B0E17F3F0B41B,70A73F7F376B60074248904534B11482D5BF0E698ECC498DF52577EBF2E93B9A,BD71FDF6DA97E4CF62D1647ADD2581B07D79ADF8397EB4ECBA9C5E8488821423:sctnotafter=1714521599
Note: If copy and pasting the above commands, ensure no line-breaks are introduced.
Learn more about command-line flags here.
I use Entrust certificates for my internal enterprise network, do I need to do anything?
Beginning in Chrome 127, enterprises can override Chrome Root Store constraints like those described for Entrust in this blog post by installing the corresponding root CA certificate as a locally-trusted root on the platform Chrome is running (e.g., installed in the Microsoft Certificate Store as a Trusted Root CA).
How do enterprises add a CA as locally-trusted?
Customer organizations should defer to platform provider guidance.
What about other Google products?
Other Google product team updates may be made available in the future.
27
Jun
2024
Virtual Escape; Real Reward: Introducing Google’s kvmCTF
Marios Pomonis, Software EngineerGoogle is committed to enhancing the security of open-source technologies, especially those that make up the foundation for many of our products, like Linux and KVM. To this end we are excited to announce the launch of ...
27
Jun
2024
How device tokens keep your payment cards safe in Google Wallet
We’re breaking down device tokens: what they are, how they work and why they make digital payments safer.
27
Jun
2024
Gemma 2 is now available to researchers and developers
Gemma 2, our next generation of open models, is now available globally for researchers and developers.
27
Jun
2024
110 new languages are coming to Google Translate
Google Translate adds 110 new languages using AI, breaking down communication barriers for millions around the world.
27
Jun
2024
Add up to 500,000 members to spaces in Google Chat
What’s changingShortly after introducing announcements in Google Chat last year, we increased the number of users you can add to a space from 8,000 to 50,000. To provide greater flexibility and inclusiveness for larger organizations, we’re excited to a...
26
Jun
2024
5 new Chrome features to help you search on mobile
We’re making it easier to search in Chrome on iOS and Android with shortcut suggestions, live sports cards and more.
26
Jun
2024
Play the I/O Crossword, an AI twist on the classic word game
How Googlers used Gemini to build the Crossword puzzle, showing developers what’s possible with generative AI.
26
Jun
2024
Improving calculation speed in Google Sheets
What’s changingWe recently announced the latest advancements in Sheets, including that we’ve doubled the speed of calculation in Google Sheets on Google Chrome and Microsoft Edge browsers. This update can improve the speed of actions like formulas, piv...
26
Jun
2024
Our testimony to the California Senate Judiciary Committee on the California Journalism Preservation Act
Testimony to the California Senate Judiciary Committee on June 25, 2024 by Jaffer Zaidi, Google VP of Global News Partnerships.
26
Jun
2024