Safari will only accept certificates less than thirteen months old

Apple has announced plans to increase Safari's security when browsing secure web pages starting September 1st. As of that date, it will only accept HTTPS certificates issued in the past thirteen months.

HTTPS is the secure version of the standard HTTP web protocol (S stands for "Secure") and certifies that the communication between the user and the server is encrypted in both directions.

HTTPS protects against routing attacks, where someone creates a WiFi hotspot with a seemingly trustworthy name and is dedicated to capturing all the traffic that passes through it. With standard HTTP, all content, including usernames and passwords, is sent in plain text. Using HTTPS the attacker only gets a salad of letters and symbols.

When a browser connects to a web page that uses HTTPS, it verifies that the page has a valid security certificate. This is essentially proof from a third party that the web pages are indeed encrypted.

Certificates only ensure that the website used the valid encryption standard that existed at the time [of the web page] was created, so an old certificate may imply that an already outdated or new encryption technology was used. that the vulnerabilities have been discovered and fixed in later versions.

Therefore, reducing a certificate's validity window increases security by ensuring that the latest versions of encryption are used.

Until the policy change occurs, Safari accepts certificates that were created up to 825 days ago (i.e. more than two years). As of September 1, 2020 Safari will only accept security certificates with a maximum age of 398 days (13 months).

If the webpage certificate is older, Safari will show a warning and advise you not to connect to the web.

If this policy is not generalized, the use of Safari could begin to produce many "unfounded" warnings that will confuse the uninformed user who is trying to visit a page they know and trust.