Site certificates

[iprice]

When using this site from work (shhhh!!) I get certificate issues and warnings to avoid this place like the plague!

I expect it's to do with not supporting IE (8!!) but it might put off people that don't know/trust this site.

I've attached an image (errr which appear to be above the post, despite me putting it below...)

 

[EvilDragon]

Hmm, it's a standard certificate, tested via some external internet testing site as well.
I wonder why IE8 doesn't like it...
The clock in your computer at work is correct?

 

[Neelix]

Hmm, it's a standard certificate, tested via some external internet testing site as well.
I wonder why IE8 doesn't like it...
The clock in your computer at work is correct?

If it's after a redirect perhaps IE is loading the certificate for boards.openpandora.org instead of for pyra-handheld.com?
Of course that's just speculation on my part, actually viewing the certificate might be useful here, to see what site IE8 thinks it is for.

-Neelix

 

[EvilDragon]

Yep, that would be helpful. I hope IE8 can show the certificate as well?

 

[thatgui]

Hmm, at least IE10 and IE11 don't show this behaviour, showing the a valid cartificate for *.pyra-handheld.com
OT: I think its a hazardous endeavour to use IE to browse the internet (except sites that rely completely on themselves and don't load content from anywhere, maybe), any chance you could use something that isn't a big security hole - like IE10?

 

[Dude]

SHA1 (encryption) is dropped as of the beginning of this year... some browsers will have a problem...
Most answers will tell you to use a more modern browser, with modern encryption.
(Could mean that the NSA can't read it easy enough? JK! JK! )

SHA1 is an old encryption standard and is being removed...

Surprising is that the new Microsoft browser is one of the most secure...

Although I still prefer Firefox as they use their own certificate table.

Some browsers are turning off support for SHA1 a little early.. but if you can manually change to SHA2 your SSL certificates will work...

 

[EvilDragon]

Hm, so IE8 might complain because I don't use an outdated certificate?

 

[Alec]

OT: I think its a hazardous endeavour to use IE to browse the internet (except sites that rely completely on themselves and don't load content from anywhere, maybe), any chance you could use something that isn't a big security hole - like IE10?

You can't run IE10 (or IE9) on Windows XP!

My guess is that it's either running an old unpatched version (SP2?) that doesn't support SHA-256, or the employer did a lazy job MITMing SSL traffic.

 

[EvilDragon]

But then again, according to the screenshot it clearly states that the certificate is for a different site, so it might really read the Pandora one...

 

[iprice]

OT: I think its a hazardous endeavour to use IE to browse the internet (except sites that rely completely on themselves and don't load content from anywhere, maybe), any chance you could use something that isn't a big security hole - like IE10?

I have to use what I'm given at work... Yep, the modern NHS still uses XP and runs IE8 (it was IE7 until recently!)

Re: certificate. It never had a problem before the update, so it's been broken somehow since then. Not a big issue for me, just thought it best to report.

 

[levi]

As a couple of people have asked, can you give us what it thinks is the certificate for this site?

If I check it (in Firefox) it says it's a certificate issued by RapidSSL and verified by Geotrust Inc. for pyra-handheld.com.

 

[singler]

My guess would be that OP's system does not support SNI (https://en.wikipedia.org/wiki/Server_Name_Indication#No_support). As both sites use same IP address, SNI support is needed to get correct certificate of virtual host

$ dig pyra-handheld.com +short
5.9.50.149
$ dig board.openpandora.org +short
5.9.50.149

In this case solution would be to get different IP address for one of the virtual hosts.

I personally would not fix this as it is only an issue for outdated systems

 

[sam fisher]

If it's just SNI I wouldn't worry about it as anything old enough to have issue with that should encounter issues all over the place on the modern web. Unless of course ED has a bunch of IPv4 addresses lying around he's not using