25

I apologise for to terseness of this question; I have an issue. Google.co.uk is failing its HSTS on my browsers.

enter image description here

Is this an issue with google.co.uk or is this just me? Is someone middle-manning my internet connection?

While I can find plenty of sites that tell me google.co.uk is working I haven't been able to establish if the HSTS issue is me or Google. I suspect it's me but would like some 3rd party confirmation.

P.S.: This appears so far just for google.co.uk, and unfortunately snuck.me doesn't seem to be working to clarify other sites' non-HSTS certificates either.

Update:

After ten minutes of being down, google.co.uk now works again, however by using snuck.me I find the following:

enter image description here

Fingerprint according to the browser:

D1:8F:DE:83:4A:68:88:32:DD:CF:C8:6B:0C:74:94:33:02:75:BC:43

finger print according to snuck.me:

42:38:CE:6C:AA:C5:FE:13:A0:5A:56:88:F3:F2:E7:E4:D7:14:07:DA

Does this confirm I have a MITM?

Improve this question
7
  • 2
    What does the presented certificate look like?
    – Arminius
    Jun 12, 2017 at 19:18
  • I get the same certificate as you do.
    – Arminius
    Jun 12, 2017 at 19:30
  • @Arminius shouldn't the fingerprints between the two sources match? If not, I don't get how the data can be compared if it's meant to be different?
    – Martin
    Jun 12, 2017 at 19:31
  • 4
    Are you on a network with a captive portal? Sometimes they try to intercept SSL connections, with this result.
    – Federico Poloni
    Jun 13, 2017 at 7:24
  • Google Switches certificates often, the external tool might have an old one cached.
    – eckes
    Jun 13, 2017 at 13:45

2 Answers 2

Reset to default
39

Your browser rejected a certificate, but this doesn't have to be caused by an attack.

Google.co.uk is failing its HSTS on my browsers.

The warning you see doesn't indicate a problem with HSTS in particular. It's just Firefox saying: "The certificate appears invalid. And by the way, we won't let you add a manual exception because the site uses HSTS." 1

There are many plausible reasons why you got served an invalid certificate for a short amount of time. It could be a hickup at your ISP, a problem with your router, SSL interception by a captive portal (as mentioned by @FedericoPoloni) or, theoretically, a poor attempt at an MITM attack. The first step of investigation would be to check which certificate you were actually served.

Afterwards, you didn't correctly compare the certificates: You connected to www.google.co.uk but ran the third-party test against google.co.uk. These are technically different domains that serve different certificates depending on the indicated server name.

Here I'm testing each -servername with openssl and you should recognize both fingerprints:

$ openssl s_client -servername www.google.co.uk -connect www.google.co.uk:443 < /dev/null 2>/dev/null | openssl x509 -fingerprint -noout -in /dev/stdin
SHA1 Fingerprint=D1:8F:DE:83:4A:68:88:32:DD:CF:C8:6B:0C:74:94:33:02:75:BC:43
$ openssl s_client -servername google.co.uk -connect www.google.co.uk:443 < /dev/null 2>/dev/null | openssl x509 -fingerprint -noout -in /dev/stdin
SHA1 Fingerprint=42:38:CE:6C:AA:C5:FE:13:A0:5A:56:88:F3:F2:E7:E4:D7:14:07:DA

1HSTS (HTTP Strict Transport Security) is a header which web servers can send to indicate that clients should never connect to the site over plain HTTP (for a specified amount of time). Your browser picked up that header during one of your previous visits to www.google.co.uk or preloaded it. One of the header's side effects is that the UI wont't allow you to ignore certificate warnings anymore by adding an exception.

Improve this answer
2
  • "It could be a hickup at your ISP, a problem with your router" - How does that work? Isn't it true that a certificate is sent by the webserver every time you make an SSL connection and providers and routers do not change the contents of a TCP stream? A problem with your ISP or router would result in a timeout instead of an insecure connection, right?
    – Paul
    Jun 13, 2017 at 13:14
  • 4
    @Paul Some routers, if they can't connect to the Internet, respond with an error page similar to a captive portal to any request by a connected device. This could cause the certificate warning because the router's certificate doesn't match the one from Google. Another scenario is that the ISP can't resolve DNS queries correctly and resolves all domains to a troubleshooting site of the ISP. This would also cause a certificate mismatch.
    – Arminius
    Jun 13, 2017 at 14:38
1

Check the time in your system. Sometimes​ I get this error when my clock (system time) is wrong or when a time miss synchronization happens.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .