SSL cert not valid on brave/chrome android


___

Advanced Member
Joined
Jan 31, 2006
Messages
3,376
Hi people,
since this morning, I am unable to access the forum on my droid 4, due to a supposedly invalid certificate. Not sure why this comes up at all, I thought a new ssl certificate was in place by now and I did not have the issue before.

Trying to access the forum through the aosp browser gives the same result. I am posting through that browser right now.

Could this be borked locally on my phone? I am puzzled as to why this occurs now...

EDIT: the error message reads NET::ERR_CERT_AUTHORITY_INVALID
 
Last edited:
It's a DigiCert Inc issued key based on an old Thawte subkey. Unless that's been revoked in you browser, I think it's a pretty old root key (although I don't keep track of these things religiously). I'm not aware they they've been caught up in anything that might persuade your browser maker to disregard their cert, but it has happened to others.
 
Well, older Thawte certificates will be reported as unsecure by Chrome soon which is why they updated all certificates. I've updated it as well and all browsers and SSL testers I tried report that it's fine.

Does anyone else have a problem?

Sent from my XT1650-03 using Tapatalk
 
still not working on my end. I can't use the forum like this, as I have to confirm chromes/braves nagscreen with every link I click. aosp browser shows the error dialog 5 times when I open the url, but at least I can read and post after I have pressed ok.
 
still not working on my end. I can't use the forum like this, as I have to confirm chromes/braves nagscreen with every link I click. aosp browser shows the error dialog 5 times when I open the url, but at least I can read and post after I have pressed ok.

Can you give me some details about what exactly fails?
It works fine on my Android phone.
 
Hi ED, I have installed firefox mobile and the error does not occurr using that. for some reason, chrome/brave always gives me the well known nag screen claiming the connection is unsafe and shows the error I have mentioned above "ERR_CERT_AUTHORITY_INVALID".

I'll try deleting appdata and see if it works again with chrome mobile.

EDIT: tried clearing cache and data for chrome and I still get that ssl error. I guess I will switch browsers once again...
 
Last edited:
Date/ time is set to auto detect from my network.Its back saying the same thing again today even after accepting it.Firefox works though so will use that.
 
I can not reproduce the issue so cant say for sure but considering the multiple report here, i think it is real. (and not just a wrong clock / incorrect setup / very old browser).

could this be related?
https://stackoverflow.com/questions...-cert-authority-invalid-on-mobile-chrome-only
apparently intermediate certs need to be served directly by the server in order for mobile browsers to accept them

The first answer on stack overflow mention it is due the server returning an extra certificate.
Although I never run into this before, that explanation seems plausible.

Checking on ssllabs:
https://www.ssllabs.com/ssltest/analyze.html?d=pyra-handheld.com
https://www.ssllabs.com/ssltest/analyze.html?d=pyra-handheld.com
  • For the "*.pyra-handheld.com" certificate, it shows there is no trust issue and that the intermediary cert is returned by the server
  • Also shows an extra certificate 'openpandora.org' (+ alternative names). It mention 'no SNI' (so only returned for non SNI TLS connection ?)
So really ssllabs does not indicate any issue unless the browser has no SNI support. This only concern really old browser that would run into that issue with many website anyway.

So I think the issue might somehow be related to the second cert. I don't know why exactly.
You should certainly be able to use multiple cert on the same IP/server with SNI.

Evildragon: Did you make changes to your web server beside just renewing the certificate ? (Vhost...)
 
firefox mobile is absolutely unusable on my droid4 (horrible input lag, can't type anything reliably), so I have to stick with brave/chrome. tried the native chrome from the playstore today instead of brave and it shows the same error as brave.
 
firefox mobile is absolutely unusable on my droid4 (horrible input lag, can't type anything reliably), so I have to stick with brave/chrome. tried the native chrome from the playstore today instead of brave and it shows the same error as brave.

No problem with either Chrome or Firefox on my Nexus 5x. I suspect it has to do with the android version.,
Anyway to get more info that "ERR_CERT_AUTHORITY_INVALID" on Chrome mobile ?
 
sadly not a far as I know. the error message is not verbose at all. I can try to reproduce on aosp browser, it seems the error message provides more information.

It maybe related to my current android version. I am using lineageOS 11 (android 4.4.4). But why is it okay in firefox mobile then?
 
my android is 4.4.2 so could be that.It says attackers might be trying to steal your info from this site.
 
well if android wasn't such a piece of broken crap, I could upload the screenshots of the message the aosp browser is showing me. but apparently that doesn't work and the uploads are not attached to my post... this pisses me off sooooo much. why can I not copy the content of an error message as plain text on this shitty excuse for a phone OS? Oh what I would give to have maemo or webOS instead...

I'll try to follow up on this when I am back home, maybe I can email the screenshots to myself and then post them on a real browser (smartphones are so convenient, really impressive)...

EDIT: lol okay so one screenshot has made it into my post... I'll try to upload the second one now.
[doublepost=1518205184,1518204592][/doublepost]
*snip* It says attackers might be trying to steal your info from this site.
yes that is what the SSL nagscreen always says. It's googles way to ensure that elderly people or people who don't know what https/TLS is, immediately panic and frantically change all their passwords. Just like the famous "I logged onto my email from another computer and now google tells me that all my data has probably been stolen by hackers" message, so that customer service providers from all over the world can spend their time on recovering lost passwords and reassuring grandma that noone wants to steal her bitcoins.
 

Attachments

  • image%3A23620.png
    image%3A23620.png
    83.3 KB · Views: 383
  • image%3A23619.png
    image%3A23619.png
    76.4 KB · Views: 333
Last edited:
Back
Top