SSL cert not valid on brave/chrome android

Discussion in 'Site Feedback' started by xnopasaranx, Feb 6, 2018.

  1. levi

    levi Still fresh, damnit!

    Joined:
    Oct 6, 2008
    Messages:
    9,768
    Location:
    Somewhere off the coast of the EU
    Weird, I can't see any diffence in the certs served to me in firefox. It's definitely using the same root certificate which others were reporting as problematic, and a very similar intermediate cert.
     
  2. Kippykip

    Kippykip BFG 9000

    Joined:
    Sep 6, 2016
    Messages:
    483
    Location:
    'STRAYA
    I'm still getting cert errors on all my PCs with the forums, the digicert site loads fine though https://www.digicert.com/digicert-root-certificates.htm
    The only other site I know of with cert errors is the RSPCA QLD, which is expected since every Australian made site is buggy as **** (completely different SSL cert error though).
     
  3. xnopasaranx

    xnopasaranx Superbad!

    Joined:
    Jan 31, 2006
    Messages:
    3,223
    yes I was a bit to eager. It's now happening again to me as well.
     
  4. EvilDragon

    EvilDragon Administrator Staff Member

    Joined:
    Mar 4, 2003
    Messages:
    19,420
    Location:
    Ingolstadt
    But this doesn't make any sense!
    I tried it on multiple devices (Windows, Linux, Android), multiple browsers (Chrome, Edge, FireFox, Vivaldi) and checked it with some internet-based SSL-Check-Sites.
    Everything is working fine here :O

    What's going on? :O
    --- Double Post Merged, Feb 11, 2018, Original Post Date: Feb 11, 2018 ---
    Can someone who has SSL issues with the site check out www.dragonbox.de?
    It's using the same certication... does that work?
     
  5. xnopasaranx

    xnopasaranx Superbad!

    Joined:
    Jan 31, 2006
    Messages:
    3,223
    yeah I am getting the same error on dragonbox.de :(

    EDIT: okay, your server host is hetzner correct? I am actually getting the same SSL error when I try to open their company homepage (noticed because I am server shopping atm)
     
  6. EvilDragon

    EvilDragon Administrator Staff Member

    Joined:
    Mar 4, 2003
    Messages:
    19,420
    Location:
    Ingolstadt
    Yes, and it seems they're also using the same G2 cert.

    I'll drop them a mail!
     
    Kippykip likes this.
  7. Kippykip

    Kippykip BFG 9000

    Joined:
    Sep 6, 2016
    Messages:
    483
    Location:
    'STRAYA
    upload_2018-2-12_4-24-40.png
    Yep, same here
     
  8. Swordfish II

    Swordfish II Very Active Member

    Joined:
    May 20, 2015
    Messages:
    687
    I was getting the error and the site wouldn't fully load. Working fine right now though.
     
  9. Galaxis

    Galaxis Member

    Joined:
    Aug 30, 2010
    Messages:
    309
    I'm not getting any errors in any web browser, so I dropped that into the SSLlabs test at https://www.ssllabs.com/ssltest/analyze.html?d=www.dragonbox.de&hideResults=on and it warns that your server will return the openpandora.org certificate when a very old client connects that doesn't support Server Name Indication. But apart from that, everything seems to be fine setup-wise?
     
  10. Swordfish II

    Swordfish II Very Active Member

    Joined:
    May 20, 2015
    Messages:
    687
    I spoke too soon, back to errors on my phone. The Pandora with the latest Pale Moon is working fine though (it said it was using a TLS handshake)
     
  11. Kippykip

    Kippykip BFG 9000

    Joined:
    Sep 6, 2016
    Messages:
    483
    Location:
    'STRAYA
    upload_2018-2-12_16-48-27.png
    Hmm I was checking out another site and I got this today, hmmmmm.
    --- Double Post Merged, Feb 12, 2018, Original Post Date: Feb 12, 2018 ---
    Turns out I might only be getting cert errors because I have windows updates turned off, ah R.I.P

    --- Double Post Merged, Feb 12, 2018 ---
    I found a solution if you're on Windows 7, the Windows Updates doesn't fix anything so open regedit.exe, go to:
    Code:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
    And give this KEY full access permissions to this account:
    Code:
    NETWORK SERVICE
    Just for safe measure I did the same to
    "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates" aswell.

    Now Win7 will be able to auto-download verified root certificates like it's supposed to, hooray!
    Although for the mobile errors people here are having, I thought I'd see what happens if I try to load this site on my Blackberry Q10 and, it loaded up just fine with no SSL errors.

    It's a shame I have to do this on all my Windows 7 machines though, but it also fixed the other sites that had similar issues I mentioned.
     
  12. crazyhorse

    crazyhorse Member

    Joined:
    Sep 9, 2009
    Messages:
    207
    mines back working again now, maybe EDs message has sorted it?
     
  13. EvilDragon

    EvilDragon Administrator Staff Member

    Joined:
    Mar 4, 2003
    Messages:
    19,420
    Location:
    Ingolstadt
    No, nothing has changed there yet.
     
  14. Kippykip

    Kippykip BFG 9000

    Joined:
    Sep 6, 2016
    Messages:
    483
    Location:
    'STRAYA
    upload_2018-2-13_1-58-19.png
    Well it's secure now once I fixed my Windows registry to update root certs, maybe the problem is that digicert is too new for legacy devices or something so they don't trust it.
     
  15. xnopasaranx

    xnopasaranx Superbad!

    Joined:
    Jan 31, 2006
    Messages:
    3,223
    well that sucks, for me it is still showing the same error.

    what can I do to get this working correctly again? I can't update my phone to a newer version of android, because I cannot repartition it to make enough space on root for the new google apps (even nano version). I will not buy a new phone (using the same model as ED himself, droid 4) under any circumstance, as long as this one still works.

    EDIT: I tested if my client is SNI capable and it is! Also it reports my client is using TLS 1.2 and everything is configured optimally.

    for the others, use this link:
    https://www.ssllabs.com/ssltest/viewMyClient.html
     
    Last edited: Feb 12, 2018
  16. the_marshal

    the_marshal Member

    Joined:
    Aug 27, 2010
    Messages:
    189
    As Evildragon said nothing changed.

    I still believe there is no configuration issue with the webserver / told setup and it is all the result of the specific CA not being included in all devices. It's a shame and I would ask support or get a cert elsewhere.

    The reality is that people getting the issue could run into this issue on another website at some point.

    Here are info for adding root CA for many devices:

    http://wiki.cacert.org/FAQ/ImportRootCert
    (You do not need to add CAcert. It's just for info)

    I am surprised some people need to modify the registry to get CA update (?!) Windows...
     
    xnopasaranx and Kippykip like this.
  17. xnopasaranx

    xnopasaranx Superbad!

    Joined:
    Jan 31, 2006
    Messages:
    3,223
    @the_marshal thank you so much for that link! I can't believe my google-fu is so bad, that I wasn't able to find an actual guide on how to import your own certificates on android. Just saved the thawte rsa ca g1 intermediate cert and imported it, now I can at least browse the forum again.
     
  18. Swordfish II

    Swordfish II Very Active Member

    Joined:
    May 20, 2015
    Messages:
    687
    My phone is working again here...strangely.

    I don't get it..literally nothing has changed for me or ED...
     
  19. Kippykip

    Kippykip BFG 9000

    Joined:
    Sep 6, 2016
    Messages:
    483
    Location:
    'STRAYA
    Odd that my outdated Blackberry didn't need to import anything and it worked, it was just my Windows 7 machines.
     
  20. the_marshal

    the_marshal Member

    Joined:
    Aug 27, 2010
    Messages:
    189
    That is strange and I can not explain it (unless there wa a MITM).

    The CA exists for a long time so not that surprising.
     

Share This Page

Loading...