1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.
  2. Dismiss Notice

SSL cert not valid on brave/chrome android

Discussion in 'Site Feedback' started by xnopasaranx, Feb 6, 2018.

  1. xnopasaranx

    xnopasaranx Superbad!

    Joined:
    Jan 31, 2006
    Messages:
    3,206
    actually that is a lot more helpful than the crap error messages on chrome for android. I have no experience with configuring SSL certificates on a server, but I think the stackoverflow issue I linked to points into a similar direction: something with the chain of certificates is not quite right (or maybe it is right, but not understood by our browsers).

    @EvilDragon I would be glad if you could tell us the cause of this, in case you can actually fix it serverside and it's not a client issue. I'll need to deal with SSL certs on my server soon enough, seeing that google will flag all non https websites as dangerous beginning in july this year...
     
    Kippykip likes this.
  2. levi

    levi Still fresh, damnit!

    Joined:
    Oct 6, 2008
    Messages:
    9,349
    Location:
    Somewhere off the coast of the EU
    That last screenie suggests it's chrome considering the Digicert Global Root G2 is not considered a valid root certificate. Firefox (except for on iOS I understand) uses the system certs, and my /etc/ssl/certs/ca-certificates.crt contains an entry for DigiCert Global Root G2, so for me it's certainly valid.
     
  3. EvilDragon

    EvilDragon Administrator Staff Member

    Joined:
    Mar 4, 2003
    Messages:
    19,353
    Location:
    Ingolstadt
    Well, the problem is that future versions of Chrome will set all OLDER Symantec certs as unsecure... however, that's the reason the certs have been updated last week... so that update should've prevented that, and that's even weirder.
     
  4. levi

    levi Still fresh, damnit!

    Joined:
    Oct 6, 2008
    Messages:
    9,349
    Location:
    Somewhere off the coast of the EU
    You mean it shouldn't be using a cert based on that DigiCert G2 key? It has been doing that since I first checked it and that was before I first posted in this thread (although that would have been the start of this week, so if you changed it last week maybe it's lack of changing isn't surprising). But if it shouldn't be using that key, I can confirm that is is in firefox on Linux also still.
     
  5. Kippykip

    Kippykip BFG 9000

    Joined:
    Sep 6, 2016
    Messages:
    476
    Location:
    'STRAYA
    The other thing I should add, is Opera is based on Chromium since a few years ago. And those screencaps I posted are from Opera. So if it's true about Chrome breaking some web standard (as always), then might explain why my Opera has the same problem.
    Also I don't think this issue was happening to me before a week ago, hmmmmmm?
     
  6. Alec

    Alec Member

    Joined:
    Mar 5, 2009
    Messages:
    430
    Seeing you're on windows, do you also get this issue when you open it in internet explorer?

    I suspect the issue might be with people having outdated CA certificates installed.

    I tried opening it in the built-in browser on my old Galaxy SII, and I also get an error. It's running KitKat 4.4. With the latest version of Firefox, it works fine because Firefox ships its own certificate store.

    Try installing uBlock Origin extension, it will improve things quite a bit.
     
    Kippykip likes this.
  7. Kippykip

    Kippykip BFG 9000

    Joined:
    Sep 6, 2016
    Messages:
    476
    Location:
    'STRAYA
    upload_2018-2-10_13-20-9.png
    Yeah happens in IE too!
     
  8. the_marshal

    the_marshal Member

    Joined:
    Aug 27, 2010
    Messages:
    185
    As other mentioned Firefox uses it's own list of trusted CA and TLS library. (for Desktop and also Android it seems but not IOS)

    The error indicate the root CA 'DigiCert Global Root G2' is not trusted (not installed on system...)
    The certificate for this website require this CA. There is no alternative trust path. (I checked)

    To be sure the issue is indeed the missing CA, can people having issue try to open:

    https://global-root-g2.chain-demos.digicert.com/

    If you get an error on this digicert test page it confirm the root CA 'DigiCert Global Root G2' is missing from your system.
     
  9. levi

    levi Still fresh, damnit!

    Joined:
    Oct 6, 2008
    Messages:
    9,349
    Location:
    Somewhere off the coast of the EU
    That's almost the opposite of my understanding. AIUI it's chrome that uses it's own certs. Firefox, on Linux uses the system certs I'm pretty sure, and that's probably true for Android and maybe true for Windows as well. It's not true on iOS because Apple rejected their port of Firefox a few years ago, so firefox on iOS is actually just a wrapper around Safari, so will do whatever Safari does most likely.

    I've not been keeping up to date with what Safari or IE or Edge do. They don't run on platforms that interest me.
     
  10. the_marshal

    the_marshal Member

    Joined:
    Aug 27, 2010
    Messages:
    185
    However it seems that nowadays Firefox include support to import system CA on windows.
    (likely an important requirement for enterprise using Active Directory CA/ central management of CA)
    I don't know how Firefox is usually packaged on Linux distro so it's possible they change the list of default trusted CA to match the system one. Unless something I am missing something the default for Firefox is still to ship its own CA store. Note that normal use can modify the default (it's part of Firefox user preference)

    Regarding Chrome

    More info here: https://www.chromium.org/Home/chromium-security/root-ca-policy

    Chrome can to blacklist specific CA/Cert. Also it used to ship with pinned certificate, in the past.
    So there is definitely some certificate related thing happening in Chrome but it still try to use the OS certificate store.

    http://www.zdnet.com/article/google-chrome-is-backing-away-from-public-key-pinning-and-heres-why/
    --- Double Post Merged, Feb 10, 2018, Original Post Date: Feb 10, 2018 ---
    Evildragon:
    When renewing your certificate did you have to chose between 'SHA-1 root CA' and 'SHA-2 root CA' ?
    If that was the case, maybe the SHA2 root option is less compatible (I am unsure, if it is it's not due to SHA2 itself as android 4 supports it).

    To be sure the cause is missing root CA can people having issue try to open:
    https://global-root-g2.chain-demos.digicert.com/
    (A TLS error on this digicert test page mean the root CA 'DigiCert Global Root G2' is not trusted on your system)

    Let's wait for confirmation first but you could consider using Letsencrypt as they now offer wildcard certificate. (free of course)
    That is if it turned out to be more compatible that you current cert: https://letsencrypt.org/docs/certificate-compatibility/
     
    levi likes this.
  11. xnopasaranx

    xnopasaranx Superbad!

    Joined:
    Jan 31, 2006
    Messages:
    3,206
    @the_marshal thanks for the explanations! I can confirm, that both test links result in the same SSL error.
     
  12. EvilDragon

    EvilDragon Administrator Staff Member

    Joined:
    Mar 4, 2003
    Messages:
    19,353
    Location:
    Ingolstadt
    Nope, it was simply reissued using the same key and request from last year (to prevent that "all Symantec certificates will become invalid by Chrome".

    Ah, they do that now? That's nice, I'm using it for most sites already, just didn't do it with our sites here as I wanted a wildcard one :)
     
    the_marshal likes this.
  13. the_marshal

    the_marshal Member

    Joined:
    Aug 27, 2010
    Messages:
    185
    Thanks for the confirmation. Last (official) android for droid 4 appear to be Android 4.1. Are you running that ?
    You do realize you're not getting security update on such an old device, right ? (don't get me started on Android update and manufacturer. It's a mess)
    You should be able to manually install the root CA on your device. 'DigiCert Global CA G2' from https://www.digicert.com/digicert-root-certificates.htm
    It's not something you normally should or have to do...

    Yes they *just* started (still early days): https://letsencrypt.org/2017/07/06/wildcard-certificates-coming-jan-2018.html

    It seems to me like nothing is wrong with your webserver config or SSL certificate. Also renewing the cert was the logical thing to do.
    Your new certificate uses a different root CA. Why it is missing from some device I don't know. (did not find much on Google)
    The CA itself exists for a long time but it appear like it only started getting used to issue cert fairly recently. (which might explain why it might have been missing and nobody noticed)
    --- Double Post Merged, Feb 10, 2018, Original Post Date: Feb 10, 2018 ---
    I guess you could try asking where you bought the cert if there are aware of this issue. If you're (really?) lucky you might get someone competent...
     
  14. crazyhorse

    crazyhorse Member

    Joined:
    Sep 9, 2009
    Messages:
    198
    Tried the manual install, didn't work.Is it only the pyra boards or are any other sites affected? All other sites i have been to are ok on chrome.
     
  15. Kippykip

    Kippykip BFG 9000

    Joined:
    Sep 6, 2016
    Messages:
    476
    Location:
    'STRAYA
    Wooah it's worse now, no images load and the page doesn't load properly. Checking the console, it said because the https://www.pyra-handheld.com wasn't valid (where the CSS and Images were loading from) while I was accessing https://pyra-handheld.com. Visiting the WWW site and clicking Continue Anyway allowed me to load the page properly
     
    Swordfish II likes this.
  16. the_marshal

    the_marshal Member

    Joined:
    Aug 27, 2010
    Messages:
    185
    Strange... can both of you confirm if you get the same error on https://global-root-g2.chain-demos.digicert.com/
     
  17. levi

    levi Still fresh, damnit!

    Joined:
    Oct 6, 2008
    Messages:
    9,349
    Location:
    Somewhere off the coast of the EU
    I'm getting a plain old connection timeout on that link FWIW.
     
  18. the_marshal

    the_marshal Member

    Joined:
    Aug 27, 2010
    Messages:
    185
  19. crazyhorse

    crazyhorse Member

    Joined:
    Sep 9, 2009
    Messages:
    198
    connection refused error
     
  20. xnopasaranx

    xnopasaranx Superbad!

    Joined:
    Jan 31, 2006
    Messages:
    3,206
    It's working again for me! no more error in brave!

    @the_marshal as I said before, I am running lineageOS and the android version is 4.4.4. I do realize that no updates are coming, but what am I supposed to do? buy another crappy android phone that I will need to root to actually own, and then slap another possibly ultra buggy custom rom onto it until that also doesn't receive updates no more?
    I think I'll wait it out with my droid 4 and replace that with the pyra, or reactivate my n900 rather then spending money on another android...
     

Share This Page

Loading...