1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.
  2. Dismiss Notice

SSL cert not valid on brave/chrome android

Discussion in 'Site Feedback' started by xnopasaranx, Feb 6, 2018.

  1. xnopasaranx

    xnopasaranx Superbad!

    Joined:
    Jan 31, 2006
    Messages:
    3,121
    Hi people,
    since this morning, I am unable to access the forum on my droid 4, due to a supposedly invalid certificate. Not sure why this comes up at all, I thought a new ssl certificate was in place by now and I did not have the issue before.

    Trying to access the forum through the aosp browser gives the same result. I am posting through that browser right now.

    Could this be borked locally on my phone? I am puzzled as to why this occurs now...

    EDIT: the error message reads NET::ERR_CERT_AUTHORITY_INVALID
     
    Last edited: Feb 6, 2018
    Tags:
  2. levi

    levi Still fresh, damnit!

    Joined:
    Oct 6, 2008
    Messages:
    8,587
    Location:
    Somewhere off the coast of the EU
    It's a DigiCert Inc issued key based on an old Thawte subkey. Unless that's been revoked in you browser, I think it's a pretty old root key (although I don't keep track of these things religiously). I'm not aware they they've been caught up in anything that might persuade your browser maker to disregard their cert, but it has happened to others.
     
  3. EvilDragon

    EvilDragon Administrator Staff Member

    Joined:
    Mar 4, 2003
    Messages:
    19,199
    Location:
    Ingolstadt
    Well, older Thawte certificates will be reported as unsecure by Chrome soon which is why they updated all certificates. I've updated it as well and all browsers and SSL testers I tried report that it's fine.

    Does anyone else have a problem?

    Sent from my XT1650-03 using Tapatalk
     
    levi likes this.
  4. crazyhorse

    crazyhorse Member

    Joined:
    Sep 9, 2009
    Messages:
    193
    Yeah i got the same, chrome on Android.
     
  5. xnopasaranx

    xnopasaranx Superbad!

    Joined:
    Jan 31, 2006
    Messages:
    3,121
  6. crazyhorse

    crazyhorse Member

    Joined:
    Sep 9, 2009
    Messages:
    193
    Its working now
     
  7. xnopasaranx

    xnopasaranx Superbad!

    Joined:
    Jan 31, 2006
    Messages:
    3,121
    still not working on my end. I can't use the forum like this, as I have to confirm chromes/braves nagscreen with every link I click. aosp browser shows the error dialog 5 times when I open the url, but at least I can read and post after I have pressed ok.
     
  8. EvilDragon

    EvilDragon Administrator Staff Member

    Joined:
    Mar 4, 2003
    Messages:
    19,199
    Location:
    Ingolstadt
    Can you give me some details about what exactly fails?
    It works fine on my Android phone.
     
  9. xnopasaranx

    xnopasaranx Superbad!

    Joined:
    Jan 31, 2006
    Messages:
    3,121
    Hi ED, I have installed firefox mobile and the error does not occurr using that. for some reason, chrome/brave always gives me the well known nag screen claiming the connection is unsafe and shows the error I have mentioned above "ERR_CERT_AUTHORITY_INVALID".

    I'll try deleting appdata and see if it works again with chrome mobile.

    EDIT: tried clearing cache and data for chrome and I still get that ssl error. I guess I will switch browsers once again...
     
    Last edited: Feb 7, 2018
  10. EvilDragon

    EvilDragon Administrator Staff Member

    Joined:
    Mar 4, 2003
    Messages:
    19,199
    Location:
    Ingolstadt
    That is totally weird...

    Sent from my XT1650-03 using Tapatalk
     
  11. Kippykip

    Kippykip BFG 9000

    Joined:
    Sep 6, 2016
    Messages:
    436
    Location:
    'STRAYA
    I was getting this on the Opera browser on all of my PCs aswell, but I just accepted it then it never comes back.
     
  12. Linux-SWAT

    Linux-SWAT Advanced Member

    Joined:
    Feb 13, 2010
    Messages:
    7,981
    Are date/time well set up ?
     
  13. crazyhorse

    crazyhorse Member

    Joined:
    Sep 9, 2009
    Messages:
    193
    Date/ time is set to auto detect from my network.Its back saying the same thing again today even after accepting it.Firefox works though so will use that.
     
  14. the_marshal

    the_marshal Member

    Joined:
    Aug 27, 2010
    Messages:
    184
    I can not reproduce the issue so cant say for sure but considering the multiple report here, i think it is real. (and not just a wrong clock / incorrect setup / very old browser).

    The first answer on stack overflow mention it is due the server returning an extra certificate.
    Although I never run into this before, that explanation seems plausible.

    Checking on ssllabs:

    https://www.ssllabs.com/ssltest/analyze.html?d=pyra-handheld.com
    • For the "*.pyra-handheld.com" certificate, it shows there is no trust issue and that the intermediary cert is returned by the server
    • Also shows an extra certificate 'openpandora.org' (+ alternative names). It mention 'no SNI' (so only returned for non SNI TLS connection ?)
    So really ssllabs does not indicate any issue unless the browser has no SNI support. This only concern really old browser that would run into that issue with many website anyway.

    So I think the issue might somehow be related to the second cert. I don't know why exactly.
    You should certainly be able to use multiple cert on the same IP/server with SNI.

    Evildragon: Did you make changes to your web server beside just renewing the certificate ? (Vhost...)
     
  15. xnopasaranx

    xnopasaranx Superbad!

    Joined:
    Jan 31, 2006
    Messages:
    3,121
    firefox mobile is absolutely unusable on my droid4 (horrible input lag, can't type anything reliably), so I have to stick with brave/chrome. tried the native chrome from the playstore today instead of brave and it shows the same error as brave.
     
  16. the_marshal

    the_marshal Member

    Joined:
    Aug 27, 2010
    Messages:
    184
    No problem with either Chrome or Firefox on my Nexus 5x. I suspect it has to do with the android version.,
    Anyway to get more info that "ERR_CERT_AUTHORITY_INVALID" on Chrome mobile ?
     
  17. xnopasaranx

    xnopasaranx Superbad!

    Joined:
    Jan 31, 2006
    Messages:
    3,121
    sadly not a far as I know. the error message is not verbose at all. I can try to reproduce on aosp browser, it seems the error message provides more information.

    It maybe related to my current android version. I am using lineageOS 11 (android 4.4.4). But why is it okay in firefox mobile then?
     
  18. crazyhorse

    crazyhorse Member

    Joined:
    Sep 9, 2009
    Messages:
    193
    my android is 4.4.2 so could be that.It says attackers might be trying to steal your info from this site.
     
  19. xnopasaranx

    xnopasaranx Superbad!

    Joined:
    Jan 31, 2006
    Messages:
    3,121
    well if android wasn't such a piece of broken crap, I could upload the screenshots of the message the aosp browser is showing me. but apparently that doesn't work and the uploads are not attached to my post... this pisses me off sooooo much. why can I not copy the content of an error message as plain text on this shitty excuse for a phone OS? Oh what I would give to have maemo or webOS instead...

    I'll try to follow up on this when I am back home, maybe I can email the screenshots to myself and then post them on a real browser (smartphones are so convenient, really impressive)...

    EDIT: lol okay so one screenshot has made it into my post... I'll try to upload the second one now.
    --- Double Post Merged, Feb 9, 2018, Original Post Date: Feb 9, 2018 ---
    yes that is what the SSL nagscreen always says. It's googles way to ensure that elderly people or people who don't know what https/TLS is, immediately panic and frantically change all their passwords. Just like the famous "I logged onto my email from another computer and now google tells me that all my data has probably been stolen by hackers" message, so that customer service providers from all over the world can spend their time on recovering lost passwords and reassuring grandma that noone wants to steal her bitcoins.
     

    Attached Files:

    Last edited: Feb 9, 2018
    crazyhorse likes this.
  20. Kippykip

    Kippykip BFG 9000

    Joined:
    Sep 6, 2016
    Messages:
    436
    Location:
    'STRAYA
    upload_2018-2-10_7-48-42.png
    upload_2018-2-10_7-50-46.png
    upload_2018-2-10_7-49-11.png upload_2018-2-10_7-49-40.png

    Do any of these help or narr?
     
    levi likes this.

Share This Page

Loading...