Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I just installed a EV SSL certificate on my server. It has been done correctly and is working, the issue is that Chrome does not show the company name in the green address bar, just shows the green padlock and green https:// like you get when you have a standard SSL certificate.

IE and Firefox display the green bar and company name as they should.

Does any one know why I'm getting this issue with chrome?

I have no insecure content on my page, I have run a check with ssllabs.com and the results came back 'B' because

This server does not mitigate the BEAST attack. Grade capped to B

BEAST attack Vulnerable INSECURE (more info)

RC4 Yes PROBLEMATIC (more info)

Does anyone know how I get around this problem? Does this mean that chrome makes more in-depth tests to check whether it's valid, more so than other browsers.

Thanks.

share|improve this question
2  
It might be a Chrome bug. code.google.com/p/chromium/issues/detail?id=226080 –  Xander Jun 12 '13 at 16:37
    
Thanks for that. –  Richard Jun 12 '13 at 18:02
add comment

2 Answers

BEAST attack Vulnerable INSECURE (more info)

RC4 Yes PROBLEMATIC (more info)

These warnings are not directly related to your certificate. They're more about your SSL configuration. When a client connects to your server over SSL, the client and server will negotiate which protocols they want to use to exchange keys and encrypt data.

BEAST is a vulnerability with SSLv3 and TLSv1. Basically there's a crypto flaw in SSLv3 and TLSv1 (fixed in TLSv1.1, which isn't widely implemented) that allows a hacker (man-in-the-middle) to attack long running sessions. You can mitigate this issue by configuring your server to use ciphers that are immune to BEAST and to prefer those ciphers.

On nginx the configuration looks like this:

ssl_ciphers RC4:HIGH:!aNULL:!MD5:!ADH:!kEDH;

ssl_prefer_server_ciphers on;

This will use RC4 with clients that support it and fall back to AES.

share|improve this answer
    
Thanks for clearing that up, I'll look into it. –  Richard Jun 12 '13 at 17:56
add comment

You can see the same effect on https://www.comodo.com/

They have an EV certificate signed by themselves. Firefox trusts it:

Comodo EV SSL cert in Firefox

but Chrome doesn't.

Comodo EV SSL cert in Chrome

Chrome works fine with Verisign:

Verisign EV SSL cert in Chrome

The problem here is likely that your browser doesn't trust your SSL certificate vendor. It's possible that you have messed up the configuration somewhere (chain certificates can be troublesome) but it will be hard for us to figure that out without you posting a URL here.

Try clicking on the lock then clicking on the Connection tab and then Certificate Information (as I have done in the second screenshot). Hopefully that screen will tell you what Chrome thinks is wrong about your certificate.

The browsers do behave differently with regards to many aspects of SSL/TLS and especially when it comes to EV certificates. Here's one example of them handling revocation differently.

share|improve this answer
3  
The example you give, https://www.comodo.com/, actually works OK for me in Chrome on Windows - I get the green bar and full company name in the address bar. –  w3d Jun 12 '13 at 14:39
    
Thanks a lot for your reply. I checked the certificate information tab and no errors being reported and chrome seems to have accepted the certificate. However on the 'details' tab there are two things that have a exclamation mark next to them, ive uploaded a screen shot here: imgur.com/jNhpvuW my URL is clippinghub.co.uk I'm not sure how I could resolve those. Or even if they would make a difference to the way chrome interacts with the certificate. edit- comodo.com also works for me on windows chrome. it's such a strange thing. –  Richard Jun 12 '13 at 14:44
    
And your domain works fine for me in both Firefox and Chrome on a Mac. –  Ladadadada Jun 12 '13 at 14:50
2  
On the screenshot, Chrome shows a greep padlock icon, while it actually thinks the certificate can't be trusted. Isn't this really bad? –  Andrey Vihrov Jun 12 '13 at 18:11
1  
The exclamation marks on the Windows certificate details pane only mean that the properties are marked as 'critical' (ie clients that don't understand the property type should fail instead of ignoring them). This is standard for the properties shown and nothing to worry about. –  bobince Jun 12 '13 at 21:09
show 4 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.