SSL cert not valid on brave/chrome android


actually that is a lot more helpful than the crap error messages on chrome for android. I have no experience with configuring SSL certificates on a server, but I think the stackoverflow issue I linked to points into a similar direction: something with the chain of certificates is not quite right (or maybe it is right, but not understood by our browsers).

@EvilDragon I would be glad if you could tell us the cause of this, in case you can actually fix it serverside and it's not a client issue. I'll need to deal with SSL certs on my server soon enough, seeing that google will flag all non https websites as dangerous beginning in july this year...
 
That last screenie suggests it's chrome considering the Digicert Global Root G2 is not considered a valid root certificate. Firefox (except for on iOS I understand) uses the system certs, and my /etc/ssl/certs/ca-certificates.crt contains an entry for DigiCert Global Root G2, so for me it's certainly valid.
 
Well, the problem is that future versions of Chrome will set all OLDER Symantec certs as unsecure... however, that's the reason the certs have been updated last week... so that update should've prevented that, and that's even weirder.
 
You mean it shouldn't be using a cert based on that DigiCert G2 key? It has been doing that since I first checked it and that was before I first posted in this thread (although that would have been the start of this week, so if you changed it last week maybe it's lack of changing isn't surprising). But if it shouldn't be using that key, I can confirm that is is in firefox on Linux also still.
 
The other thing I should add, is Opera is based on Chromium since a few years ago. And those screencaps I posted are from Opera. So if it's true about Chrome breaking some web standard (as always), then might explain why my Opera has the same problem.
Also I don't think this issue was happening to me before a week ago, hmmmmmm?
 
The other thing I should add, is Opera is based on Chromium since a few years ago. And those screencaps I posted are from Opera. So if it's true about Chrome breaking some web standard (as always), then might explain why my Opera has the same problem.
Also I don't think this issue was happening to me before a week ago, hmmmmmm?

Seeing you're on windows, do you also get this issue when you open it in internet explorer?

I suspect the issue might be with people having outdated CA certificates installed.

I tried opening it in the built-in browser on my old Galaxy SII, and I also get an error. It's running KitKat 4.4. With the latest version of Firefox, it works fine because Firefox ships its own certificate store.

firefox mobile is absolutely unusable on my droid4 (horrible input lag, can't type anything reliably), so I have to stick with brave/chrome. tried the native chrome from the playstore today instead of brave and it shows the same error as brave.

Try installing uBlock Origin extension, it will improve things quite a bit.
 
Seeing you're on windows, do you also get this issue when you open it in internet explorer?

I suspect the issue might be with people having outdated CA certificates installed.

I tried opening it in the built-in browser on my old Galaxy SII, and I also get an error. It's running KitKat 4.4. With the latest version of Firefox, it works fine because Firefox ships its own certificate store.



Try installing uBlock Origin extension, it will improve things quite a bit.
upload_2018-2-10_13-20-9.png

Yeah happens in IE too!
 
As other mentioned Firefox uses it's own list of trusted CA and TLS library. (for Desktop and also Android it seems but not IOS)

The error indicate the root CA 'DigiCert Global Root G2' is not trusted (not installed on system...)
The certificate for this website require this CA. There is no alternative trust path. (I checked)

To be sure the issue is indeed the missing CA, can people having issue try to open:

https://global-root-g2.chain-demos.digicert.com/

If you get an error on this digicert test page it confirm the root CA 'DigiCert Global Root G2' is missing from your system.
 
As other mentioned Firefox uses it's own list of trusted CA and TLS library. (for Desktop and also Android it seems but not IOS)
That's almost the opposite of my understanding. AIUI it's chrome that uses it's own certs. Firefox, on Linux uses the system certs I'm pretty sure, and that's probably true for Android and maybe true for Windows as well. It's not true on iOS because Apple rejected their port of Firefox a few years ago, so firefox on iOS is actually just a wrapper around Safari, so will do whatever Safari does most likely.

I've not been keeping up to date with what Safari or IE or Edge do. They don't run on platforms that interest me.
 
That's almost the opposite of my understanding. AIUI it's chrome that uses it's own certs. Firefox, on Linux uses the system certs I'm pretty sure, and that's probably true for Android and maybe true for Windows as well. It's not true on iOS because Apple rejected their port of Firefox a few years ago, so firefox on iOS is actually just a wrapper around Safari, so will do whatever Safari does most likely.

I've not been keeping up to date with what Safari or IE or Edge do. They don't run on platforms that interest me.

However it seems that nowadays Firefox include support to import system CA on windows.
(likely an important requirement for enterprise using Active Directory CA/ central management of CA)
I don't know how Firefox is usually packaged on Linux distro so it's possible they change the list of default trusted CA to match the system one. Unless something I am missing something the default for Firefox is still to ship its own CA store. Note that normal use can modify the default (it's part of Firefox user preference)

Regarding Chrome

Google Chrome attempts to use the root certificate store of the underlying operating system to determine whether an SSL certificate presented by a site is indeed trustworthy, with a few exceptions.

More info here: https://www.chromium.org/Home/chromium-security/root-ca-policy

Chrome can to blacklist specific CA/Cert. Also it used to ship with pinned certificate, in the past.
So there is definitely some certificate related thing happening in Chrome but it still try to use the OS certificate store.

http://www.zdnet.com/article/google-chrome-is-backing-away-from-public-key-pinning-and-heres-why/
[doublepost=1518255660,1518243391][/doublepost]Evildragon:
When renewing your certificate did you have to chose between 'SHA-1 root CA' and 'SHA-2 root CA' ?
If that was the case, maybe the SHA2 root option is less compatible (I am unsure, if it is it's not due to SHA2 itself as android 4 supports it).

To be sure the cause is missing root CA can people having issue try to open:
https://global-root-g2.chain-demos.digicert.com/
(A TLS error on this digicert test page mean the root CA 'DigiCert Global Root G2' is not trusted on your system)

Let's wait for confirmation first but you could consider using Letsencrypt as they now offer wildcard certificate. (free of course)
That is if it turned out to be more compatible that you current cert: https://letsencrypt.org/docs/certificate-compatibility/
 
When renewing your certificate did you have to chose between 'SHA-1 root CA' and 'SHA-2 root CA' ?
If that was the case, maybe the SHA2 root option is less compatible (I am unsure, if it is it's not due to SHA2 itself as android 4 supports it).

Nope, it was simply reissued using the same key and request from last year (to prevent that "all Symantec certificates will become invalid by Chrome".

Let's wait for confirmation first but you could consider using Letsencrypt as they now offer wildcard certificate. (free of course)
That is if it turned out to be more compatible that you current cert: https://letsencrypt.org/docs/certificate-compatibility/

Ah, they do that now? That's nice, I'm using it for most sites already, just didn't do it with our sites here as I wanted a wildcard one :)
 
@the_marshal thanks for the explanations! I can confirm, that both test links result in the same SSL error.

Thanks for the confirmation. Last (official) android for droid 4 appear to be Android 4.1. Are you running that ?
You do realize you're not getting security update on such an old device, right ? (don't get me started on Android update and manufacturer. It's a mess)
You should be able to manually install the root CA on your device. 'DigiCert Global CA G2' from https://www.digicert.com/digicert-root-certificates.htm
It's not something you normally should or have to do...

Ah, they do that now? That's nice, I'm using it for most sites already, just didn't do it with our sites here as I wanted a wildcard one :)

Yes they *just* started (still early days): https://letsencrypt.org/2017/07/06/wildcard-certificates-coming-jan-2018.html

It seems to me like nothing is wrong with your webserver config or SSL certificate. Also renewing the cert was the logical thing to do.
Your new certificate uses a different root CA. Why it is missing from some device I don't know. (did not find much on Google)
The CA itself exists for a long time but it appear like it only started getting used to issue cert fairly recently. (which might explain why it might have been missing and nobody noticed)
[doublepost=1518263000,1518262816][/doublepost]I guess you could try asking where you bought the cert if there are aware of this issue. If you're (really?) lucky you might get someone competent...
 
Tried the manual install, didn't work.Is it only the pyra boards or are any other sites affected? All other sites i have been to are ok on chrome.
 
It's working again for me! no more error in brave!

@the_marshal as I said before, I am running lineageOS and the android version is 4.4.4. I do realize that no updates are coming, but what am I supposed to do? buy another crappy android phone that I will need to root to actually own, and then slap another possibly ultra buggy custom rom onto it until that also doesn't receive updates no more?
I think I'll wait it out with my droid 4 and replace that with the pyra, or reactivate my n900 rather then spending money on another android...
 
Back
Top