Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 2 down vote favorite
1

Bank Website

I went to log onto my bank's internet banking website this morning using Google Chrome browser on my iPad. I get the red error message of death. I can't figure out why. It's happening on both my iPad and iPhone.

When I log onto the same website on Safari, I don't get a warning, and everything is dandy. Google chrome on my computer doesn't do the same thing. It thinks the website is fine too.

How do I get certificate information, or figure out why it's failing the verification?

share|improve this question

2 Answers

up vote 2 down vote accepted

The reason for the error, is that the intermediate certificates aren't supplied in the chain by their webserver. Basically the SSL certificate was signed by "VeriSign Class 3 Extended Validation SSL SGC CA", but that's an intermediate CA (that was signed by "VeriSign Class 3 Public Primary Certification Authority - G5"). Ideally, internetbanking.suncorpbank.com.au would chain the certificates together and also return the intermediate certificate. For example, in firefox going to the site I get:

Firefox Complaining about no intermediate certificate

Other browsers aren't complaining as they are looking up the intermediate certificates.

For an analysis of this website and an explanation of the Chain Issue: Incomplete. Also see google ios chrome help where they noted this issue.

share|improve this answer
That's a pretty cool website. ssllabs.com/ssltest. I'll remember that one.. thanks. – Mike Feb 22 at 0:02
up vote 1 down vote

The reason it happens in some browsers and not others is because these intermediate CAs are constantly changing in comparison to the root CAs. This means that browsers (as well as software such as openssl) must constantly update who their trusted CAs are. If an intermediate CA is a trusted CA, then the server you're connecting to does not need to provide the intermediate CA as it's already trusted.

This is evidenced by the DigiNotar and Comodo breaches. These CAs were trusted CAs in most browsers, so when a client received a certificate signed by one of these CAs it did not verify that the certificate of the CA was signed by a root CA. So even if the root CA who issued the certificate for this breached intermediate CA started rejecting signing verifications, it would still appear to be a trusted SSL connection because the browser never asked the root CA if the intermediate's certificate was valid. This meant that mozilla, google, microsoft among others now had to issue security updates to their browsers to remove the compromised CA from being a trusted CA.

So when you see that one browser is accepting a certificate but another browser is not, you don't want to simply accept the rejected one because it's possible that the rejecting client is more up to date than the accepting one. At this point upgrade the rejecting software to the most recent version and see if that fixes the problem (or upgrade the accepting version to see if it now rejects the certificate). If that does not solve the problem then you should contact the company you're trying to communicate with and let them know of the problem. Do not blindly trust a certificate just because one browser accepts it but another does not.

share|improve this answer
Wasn't going to blindly trust it, hence why I'm asking. – Mike Feb 22 at 0:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.