SSL cert not valid on brave/chrome android

[levi]

It's working again for me! no more error in brave!

Weird, I can't see any diffence in the certs served to me in firefox. It's definitely using the same root certificate which others were reporting as problematic, and a very similar intermediate cert.

 

[Kippykip]

I'm still getting cert errors on all my PCs with the forums, the digicert site loads fine though https://www.digicert.com/digicert-root-certificates.htm
The only other site I know of with cert errors is the RSPCA QLD, which is expected since every Australian made site is buggy as **** (completely different SSL cert error though).

 

[___]

yes I was a bit to eager. It's now happening again to me as well.

 

[EvilDragon]

But this doesn't make any sense!
I tried it on multiple devices (Windows, Linux, Android), multiple browsers (Chrome, Edge, FireFox, Vivaldi) and checked it with some internet-based SSL-Check-Sites.
Everything is working fine here :O

What's going on? :O
[doublepost=1518370493,1518370454][/doublepost]Can someone who has SSL issues with the site check out www.dragonbox.de?
It's using the same certication... does that work?

 

[___]

yeah I am getting the same error on dragonbox.de

EDIT: okay, your server host is hetzner correct? I am actually getting the same SSL error when I try to open their company homepage (noticed because I am server shopping atm)

 

[EvilDragon]

yeah I am getting the same error on dragonbox.de

EDIT: okay, your server host is hetzner correct? I am actually getting the same SSL error when I try to open their company homepage (noticed because I am server shopping atm)

Yes, and it seems they're also using the same G2 cert.

I'll drop them a mail!

 

[Kippykip]

But this doesn't make any sense!
I tried it on multiple devices (Windows, Linux, Android), multiple browsers (Chrome, Edge, FireFox, Vivaldi) and checked it with some internet-based SSL-Check-Sites.
Everything is working fine here :O

What's going on? :O
[doublepost=1518370493,1518370454][/doublepost]Can someone who has SSL issues with the site check out www.dragonbox.de?
It's using the same certication... does that work?

Yep, same here

 

[Swordfish II]

I was getting the error and the site wouldn't fully load. Working fine right now though.

 

[Galaxis]

[doublepost=1518370493,1518370454][/doublepost]Can someone who has SSL issues with the site check out www.dragonbox.de?
It's using the same certication... does that work?

I'm not getting any errors in any web browser, so I dropped that into the SSLlabs test at https://www.ssllabs.com/ssltest/analyze.html?d=www.dragonbox.de&hideResults=on and it warns that your server will return the openpandora.org certificate when a very old client connects that doesn't support Server Name Indication. But apart from that, everything seems to be fine setup-wise?

 

[Swordfish II]

I was getting the error and the site wouldn't fully load. Working fine right now though.

I spoke too soon, back to errors on my phone. The Pandora with the latest Pale Moon is working fine though (it said it was using a TLS handshake)

 

[Kippykip]

Hmm I was checking out another site and I got this today, hmmmmm.
[doublepost=1518427428,1518418151][/doublepost]Turns out I might only be getting cert errors because I have windows updates turned off, ah R.I.P
[doublepost=1518444313][/doublepost]I found a solution if you're on Windows 7, the Windows Updates doesn't fix anything so open regedit.exe, go to:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

And give this KEY full access permissions to this account:

NETWORK SERVICE

Just for safe measure I did the same to
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates" aswell.

Now Win7 will be able to auto-download verified root certificates like it's supposed to, hooray!
Although for the mobile errors people here are having, I thought I'd see what happens if I try to load this site on my Blackberry Q10 and, it loaded up just fine with no SSL errors.

It's a shame I have to do this on all my Windows 7 machines though, but it also fixed the other sites that had similar issues I mentioned.

 

[crazyhorse]

mines back working again now, maybe EDs message has sorted it?

 

[EvilDragon]

mines back working again now, maybe EDs message has sorted it?

No, nothing has changed there yet.

 

[Kippykip]

Well it's secure now once I fixed my Windows registry to update root certs, maybe the problem is that digicert is too new for legacy devices or something so they don't trust it.

 

[___]

well that sucks, for me it is still showing the same error.

what can I do to get this working correctly again? I can't update my phone to a newer version of android, because I cannot repartition it to make enough space on root for the new google apps (even nano version). I will not buy a new phone (using the same model as ED himself, droid 4) under any circumstance, as long as this one still works.

EDIT: I tested if my client is SNI capable and it is! Also it reports my client is using TLS 1.2 and everything is configured optimally.

for the others, use this link:
https://www.ssllabs.com/ssltest/viewMyClient.html

 

[the_marshal]

As Evildragon said nothing changed.

I still believe there is no configuration issue with the webserver / told setup and it is all the result of the specific CA not being included in all devices. It's a shame and I would ask support or get a cert elsewhere.

The reality is that people getting the issue could run into this issue on another website at some point.

Here are info for adding root CA for many devices:

http://wiki.cacert.org/FAQ/ImportRootCert
(You do not need to add CAcert. It's just for info)

I am surprised some people need to modify the registry to get CA update (?!) Windows...

 

[___]

@the_marshal thank you so much for that link! I can't believe my google-fu is so bad, that I wasn't able to find an actual guide on how to import your own certificates on android. Just saved the thawte rsa ca g1 intermediate cert and imported it, now I can at least browse the forum again.

 

[Swordfish II]

My phone is working again here...strangely.

I don't get it..literally nothing has changed for me or ED...

 

[Kippykip]

@the_marshal thank you so much for that link! I can't believe my google-fu is so bad, that I wasn't able to find an actual guide on how to import your own certificates on android. Just saved the thawte rsa ca g1 intermediate cert and imported it, now I can at least browse the forum again.

Odd that my outdated Blackberry didn't need to import anything and it worked, it was just my Windows 7 machines.

 

[the_marshal]

My phone is working again here...strangely.

I don't get it..literally nothing has changed for me or ED...

That is strange and I can not explain it (unless there wa a MITM).

Odd that my outdated Blackberry didn't need to import anything and it worked, it was just my Windows 7 machines.

The CA exists for a long time so not that surprising.