SSL cert not valid on brave/chrome android

[___]

Hi people,
since this morning, I am unable to access the forum on my droid 4, due to a supposedly invalid certificate. Not sure why this comes up at all, I thought a new ssl certificate was in place by now and I did not have the issue before.

Trying to access the forum through the aosp browser gives the same result. I am posting through that browser right now.

Could this be borked locally on my phone? I am puzzled as to why this occurs now...

EDIT: the error message reads NET::ERR_CERT_AUTHORITY_INVALID

 

[levi]

It's a DigiCert Inc issued key based on an old Thawte subkey. Unless that's been revoked in you browser, I think it's a pretty old root key (although I don't keep track of these things religiously). I'm not aware they they've been caught up in anything that might persuade your browser maker to disregard their cert, but it has happened to others.

 

[EvilDragon]

Well, older Thawte certificates will be reported as unsecure by Chrome soon which is why they updated all certificates. I've updated it as well and all browsers and SSL testers I tried report that it's fine.

Does anyone else have a problem?

Sent from my XT1650-03 using Tapatalk

 

[crazyhorse]

Yeah i got the same, chrome on Android.

 

[___]

could this be related?
https://stackoverflow.com/questions...-cert-authority-invalid-on-mobile-chrome-only
apparently intermediate certs need to be served directly by the server in order for mobile browsers to accept them

 

[crazyhorse]

Its working now

 

[___]

still not working on my end. I can't use the forum like this, as I have to confirm chromes/braves nagscreen with every link I click. aosp browser shows the error dialog 5 times when I open the url, but at least I can read and post after I have pressed ok.

 

[EvilDragon]

still not working on my end. I can't use the forum like this, as I have to confirm chromes/braves nagscreen with every link I click. aosp browser shows the error dialog 5 times when I open the url, but at least I can read and post after I have pressed ok.

Can you give me some details about what exactly fails?
It works fine on my Android phone.

 

[___]

Hi ED, I have installed firefox mobile and the error does not occurr using that. for some reason, chrome/brave always gives me the well known nag screen claiming the connection is unsafe and shows the error I have mentioned above "ERR_CERT_AUTHORITY_INVALID".

I'll try deleting appdata and see if it works again with chrome mobile.

EDIT: tried clearing cache and data for chrome and I still get that ssl error. I guess I will switch browsers once again...

 

[EvilDragon]

That is totally weird...

Sent from my XT1650-03 using Tapatalk

 

[Kippykip]

I was getting this on the Opera browser on all of my PCs aswell, but I just accepted it then it never comes back.

 

[Linux-SWAT]

Are date/time well set up ?

 

[crazyhorse]

Date/ time is set to auto detect from my network.Its back saying the same thing again today even after accepting it.Firefox works though so will use that.

 

[the_marshal]

I can not reproduce the issue so cant say for sure but considering the multiple report here, i think it is real. (and not just a wrong clock / incorrect setup / very old browser).

could this be related?
https://stackoverflow.com/questions...-cert-authority-invalid-on-mobile-chrome-only
apparently intermediate certs need to be served directly by the server in order for mobile browsers to accept them

The first answer on stack overflow mention it is due the server returning an extra certificate.
Although I never run into this before, that explanation seems plausible.

Checking on ssllabs:
https://www.ssllabs.com/ssltest/analyze.html?d=pyra-handheld.com
https://www.ssllabs.com/ssltest/analyze.html?d=pyra-handheld.com

• For the "*.pyra-handheld.com" certificate, it shows there is no trust issue and that the intermediary cert is returned by the server
• Also shows an extra certificate 'openpandora.org' (+ alternative names). It mention 'no SNI' (so only returned for non SNI TLS connection ?)

So really ssllabs does not indicate any issue unless the browser has no SNI support. This only concern really old browser that would run into that issue with many website anyway.

So I think the issue might somehow be related to the second cert. I don't know why exactly.
You should certainly be able to use multiple cert on the same IP/server with SNI.

Evildragon: Did you make changes to your web server beside just renewing the certificate ? (Vhost...)

 

[___]

firefox mobile is absolutely unusable on my droid4 (horrible input lag, can't type anything reliably), so I have to stick with brave/chrome. tried the native chrome from the playstore today instead of brave and it shows the same error as brave.

 

[the_marshal]

firefox mobile is absolutely unusable on my droid4 (horrible input lag, can't type anything reliably), so I have to stick with brave/chrome. tried the native chrome from the playstore today instead of brave and it shows the same error as brave.

No problem with either Chrome or Firefox on my Nexus 5x. I suspect it has to do with the android version.,
Anyway to get more info that "ERR_CERT_AUTHORITY_INVALID" on Chrome mobile ?

 

[___]

sadly not a far as I know. the error message is not verbose at all. I can try to reproduce on aosp browser, it seems the error message provides more information.

It maybe related to my current android version. I am using lineageOS 11 (android 4.4.4). But why is it okay in firefox mobile then?

 

[crazyhorse]

my android is 4.4.2 so could be that.It says attackers might be trying to steal your info from this site.

 

[___]

well if android wasn't such a piece of broken crap, I could upload the screenshots of the message the aosp browser is showing me. but apparently that doesn't work and the uploads are not attached to my post... this pisses me off sooooo much. why can I not copy the content of an error message as plain text on this shitty excuse for a phone OS? Oh what I would give to have maemo or webOS instead...

I'll try to follow up on this when I am back home, maybe I can email the screenshots to myself and then post them on a real browser (smartphones are so convenient, really impressive)...

EDIT: lol okay so one screenshot has made it into my post... I'll try to upload the second one now.
[doublepost=1518205184,1518204592][/doublepost]

*snip* It says attackers might be trying to steal your info from this site.

yes that is what the SSL nagscreen always says. It's googles way to ensure that elderly people or people who don't know what https/TLS is, immediately panic and frantically change all their passwords. Just like the famous "I logged onto my email from another computer and now google tells me that all my data has probably been stolen by hackers" message, so that customer service providers from all over the world can spend their time on recovering lost passwords and reassuring grandma that noone wants to steal her bitcoins.

 

[Kippykip]

Do any of these help or narr?