SSL cert not valid on brave/chrome android


actually that is a lot more helpful than the crap error messages on chrome for android. I have no experience with configuring SSL certificates on a server, but I think the stackoverflow issue I linked to points into a similar direction: something with the chain of certificates is not quite right (or maybe it is right, but not understood by our browsers).

@EvilDragon I would be glad if you could tell us the cause of this, in case you can actually fix it serverside and it's not a client issue. I'll need to deal with SSL certs on my server soon enough, seeing that google will flag all non https websites as dangerous beginning in july this year...
 
That last screenie suggests it's chrome considering the Digicert Global Root G2 is not considered a valid root certificate. Firefox (except for on iOS I understand) uses the system certs, and my /etc/ssl/certs/ca-certificates.crt contains an entry for DigiCert Global Root G2, so for me it's certainly valid.
 
Well, the problem is that future versions of Chrome will set all OLDER Symantec certs as unsecure... however, that's the reason the certs have been updated last week... so that update should've prevented that, and that's even weirder.
 
You mean it shouldn't be using a cert based on that DigiCert G2 key? It has been doing that since I first checked it and that was before I first posted in this thread (although that would have been the start of this week, so if you changed it last week maybe it's lack of changing isn't surprising). But if it shouldn't be using that key, I can confirm that is is in firefox on Linux also still.
 
The other thing I should add, is Opera is based on Chromium since a few years ago. And those screencaps I posted are from Opera. So if it's true about Chrome breaking some web standard (as always), then might explain why my Opera has the same problem.
Also I don't think this issue was happening to me before a week ago, hmmmmmm?
 
Kippykip said:
The other thing I should add, is Opera is based on Chromium since a few years ago. And those screencaps I posted are from Opera. So if it's true about Chrome breaking some web standard (as always), then might explain why my Opera has the same problem.
Also I don't think this issue was happening to me before a week ago, hmmmmmm?
Click to expand...

Seeing you're on windows, do you also get this issue when you open it in internet explorer?

I suspect the issue might be with people having outdated CA certificates installed.

I tried opening it in the built-in browser on my old Galaxy SII, and I also get an error. It's running KitKat 4.4. With the latest version of Firefox, it works fine because Firefox ships its own certificate store.

xnopasaranx said:
firefox mobile is absolutely unusable on my droid4 (horrible input lag, can't type anything reliably), so I have to stick with brave/chrome. tried the native chrome from the playstore today instead of brave and it shows the same error as brave.
Click to expand...

Try installing uBlock Origin extension, it will improve things quite a bit.
 
Alec said:
Seeing you're on windows, do you also get this issue when you open it in internet explorer?

I suspect the issue might be with people having outdated CA certificates installed.

I tried opening it in the built-in browser on my old Galaxy SII, and I also get an error. It's running KitKat 4.4. With the latest version of Firefox, it works fine because Firefox ships its own certificate store.



Try installing uBlock Origin extension, it will improve things quite a bit.
Click to expand...
upload_2018-2-10_13-20-9.png

Yeah happens in IE too!
 
As other mentioned Firefox uses it's own list of trusted CA and TLS library. (for Desktop and also Android it seems but not IOS)

The error indicate the root CA 'DigiCert Global Root G2' is not trusted (not installed on system...)
The certificate for this website require this CA. There is no alternative trust path. (I checked)

To be sure the issue is indeed the missing CA, can people having issue try to open:

https://global-root-g2.chain-demos.digicert.com/

If you get an error on this digicert test page it confirm the root CA 'DigiCert Global Root G2' is missing from your system.
 
the_marshal said:
As other mentioned Firefox uses it's own list of trusted CA and TLS library. (for Desktop and also Android it seems but not IOS)
Click to expand...
That's almost the opposite of my understanding. AIUI it's chrome that uses it's own certs. Firefox, on Linux uses the system certs I'm pretty sure, and that's probably true for Android and maybe true for Windows as well. It's not true on iOS because Apple rejected their port of Firefox a few years ago, so firefox on iOS is actually just a wrapper around Safari, so will do whatever Safari does most likely.

I've not been keeping up to date with what Safari or IE or Edge do. They don't run on platforms that interest me.
 
levi said:
That's almost the opposite of my understanding. AIUI it's chrome that uses it's own certs. Firefox, on Linux uses the system certs I'm pretty sure, and that's probably true for Android and maybe true for Windows as well. It's not true on iOS because Apple rejected their port of Firefox a few years ago, so firefox on iOS is actually just a wrapper around Safari, so will do whatever Safari does most likely.

I've not been keeping up to date with what Safari or IE or Edge do. They don't run on platforms that interest me.
Click to expand...

However it seems that nowadays Firefox include support to import system CA on windows.
(likely an important requirement for enterprise using Active Directory CA/ central management of CA)
I don't know how Firefox is usually packaged on Linux distro so it's possible they change the list of default trusted CA to match the system one. Unless something I am missing something the default for Firefox is still to ship its own CA store. Note that normal use can modify the default (it's part of Firefox user preference)

Regarding Chrome

Google Chrome attempts to use the root certificate store of the underlying operating system to determine whether an SSL certificate presented by a site is indeed trustworthy, with a few exceptions.
Click to expand...

More info here: https://www.chromium.org/Home/chromium-security/root-ca-policy

Chrome can to blacklist specific CA/Cert. Also it used to ship with pinned certificate, in the past.
So there is definitely some certificate related thing happening in Chrome but it still try to use the OS certificate store.

http://www.zdnet.com/article/google-chrome-is-backing-away-from-public-key-pinning-and-heres-why/
[doublepost=1518255660,1518243391][/doublepost]Evildragon:
When renewing your certificate did you have to chose between 'SHA-1 root CA' and 'SHA-2 root CA' ?
If that was the case, maybe the SHA2 root option is less compatible (I am unsure, if it is it's not due to SHA2 itself as android 4 supports it).

To be sure the cause is missing root CA can people having issue try to open:
https://global-root-g2.chain-demos.digicert.com/
(A TLS error on this digicert test page mean the root CA 'DigiCert Global Root G2' is not trusted on your system)

Let's wait for confirmation first but you could consider using Letsencrypt as they now offer wildcard certificate. (free of course)
That is if it turned out to be more compatible that you current cert: https://letsencrypt.org/docs/certificate-compatibility/
 
the_marshal said:
When renewing your certificate did you have to chose between 'SHA-1 root CA' and 'SHA-2 root CA' ?
If that was the case, maybe the SHA2 root option is less compatible (I am unsure, if it is it's not due to SHA2 itself as android 4 supports it).
Click to expand...

Nope, it was simply reissued using the same key and request from last year (to prevent that "all Symantec certificates will become invalid by Chrome".

Let's wait for confirmation first but you could consider using Letsencrypt as they now offer wildcard certificate. (free of course)
That is if it turned out to be more compatible that you current cert: https://letsencrypt.org/docs/certificate-compatibility/
Click to expand...

Ah, they do that now? That's nice, I'm using it for most sites already, just didn't do it with our sites here as I wanted a wildcard one :)
 
xnopasaranx said:
@the_marshal thanks for the explanations! I can confirm, that both test links result in the same SSL error.
Click to expand...

Thanks for the confirmation. Last (official) android for droid 4 appear to be Android 4.1. Are you running that ?
You do realize you're not getting security update on such an old device, right ? (don't get me started on Android update and manufacturer. It's a mess)
You should be able to manually install the root CA on your device. 'DigiCert Global CA G2' from https://www.digicert.com/digicert-root-certificates.htm
It's not something you normally should or have to do...

EvilDragon said:
Ah, they do that now? That's nice, I'm using it for most sites already, just didn't do it with our sites here as I wanted a wildcard one :)
Click to expand...

Yes they *just* started (still early days): https://letsencrypt.org/2017/07/06/wildcard-certificates-coming-jan-2018.html

It seems to me like nothing is wrong with your webserver config or SSL certificate. Also renewing the cert was the logical thing to do.
Your new certificate uses a different root CA. Why it is missing from some device I don't know. (did not find much on Google)
The CA itself exists for a long time but it appear like it only started getting used to issue cert fairly recently. (which might explain why it might have been missing and nobody noticed)
[doublepost=1518263000,1518262816][/doublepost]I guess you could try asking where you bought the cert if there are aware of this issue. If you're (really?) lucky you might get someone competent...
 
Tried the manual install, didn't work.Is it only the pyra boards or are any other sites affected? All other sites i have been to are ok on chrome.
 
It's working again for me! no more error in brave!

@the_marshal as I said before, I am running lineageOS and the android version is 4.4.4. I do realize that no updates are coming, but what am I supposed to do? buy another crappy android phone that I will need to root to actually own, and then slap another possibly ultra buggy custom rom onto it until that also doesn't receive updates no more?
I think I'll wait it out with my droid 4 and replace that with the pyra, or reactivate my n900 rather then spending money on another android...
 
You must log in or register to reply here.

Similar threads

the_marshal
Mailing list - invalid certificate (https://pyra-handheld.com:1717/...)
Replies
1
Views
2K
levi
levi
Gandi
Release Citrix Reciever on the Pandora
Replies
16
Views
7K
Wally
Wally
SNESFAN
google chrome laptop
Replies
6
Views
3K
Nivek10
Nivek10
A
Pandora Extended Utils on Pandora
Replies
2
Views
2K
alephhat
A
G
Thinking Of Uninstalling Ie From Xp...
2
Replies
28
Views
3K
yaustar
yaustar
Back
Top