1

Operating System: Mac OSX El Capitan 10.11.5

When browsing to the page I have a Privacy error, although an exception was added.

enter image description here

I have the correct CER file so I added it to my Keychain

TRUST THE CERT on Mac System Keychain

enter image description here

enter image description here

In CHROME Version 51.0.2704.106 (64-bit), still getting an ERROR

THE MESSAGE IN CHROME: [FILTERED].com normally uses encryption to protect your information. When Google Chrome tried to connect to [FILTERED].com this time, the website sent back unusual and incorrect credentials. This may happen when an attacker is trying to pretend to be [FILTERED].com, or a Wi-Fi sign-in screen has interrupted the connection. Your information is still secure because Google Chrome stopped the connection before any data was exchanged.

You cannot visit [FILTERED].com right now because the website sent scrambled credentials that Google Chrome cannot process. Network errors and attacks are usually temporary, so this page will probably work later.

enter image description here

In the URL bar, HTTPS red cross on the lock although "The is certificate is Valid" and marked as Trusted.

In the Security Overview Console, "This page is insecure". Any further pointers?

The self signed certificate should be fine, a friend got it working on a Windows environment. So I may be doing it wrong on my Mac, although, I am pretty sure I've done the necessary.

I have also tried on Firefox and still I get the error.

enter image description here

Any further pointers?

UPDATE 1

openssl s_client -connect mywebsite.com:443

CONNECTED(00000003)
depth=1 /CN=Root Certificate/C=US/ST=California/L=San Jose/O=MyCompany/OU=Self Signed
verify error:num=19:self signed certificate in certificate chain
verify return:0
---
Certificate chain
 0 s:/CN=*.mycompany-labs.com/C=US/ST=California/L=San Jose/O=MyCompany/OU=On Demand
   i:/CN=Root Certificate/C=US/ST=California/L=San Jose/O=MyCompany/OU=Self Signed
 1 s:/CN=Root Certificate/C=US/ST=California/L=San Jose/O=MyCompany/OU=Self Signed
   i:/CN=Root Certificate/C=US/ST=California/L=San Jose/O=MyCompany/OU=Self Signed
---
Server certificate
-----BEGIN CERTIFICATE-----
[FILTERED]
-----END CERTIFICATE-----
subject=/CN=*.MyCompany-labs.com/C=US/ST=California/L=San Jose/O=MyCompany/OU=On Demand
issuer=/CN=Root Certificate/C=US/ST=California/L=San Jose/O=MyCompany/OU=Self Signed
---
No client certificate CA names sent
---
SSL handshake has read 2072 bytes and written 456 bytes
---
New, TLSv1/SSLv3, Cipher is AES256-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1
    Cipher    : AES256-SHA
    Session-ID: [FILTERED]
    Session-ID-ctx: 
    Master-Key: [FILTERED]
    Key-Arg   : None
    Start Time: 1468885016
    Timeout   : 300 (sec)
    Verify return code: 19 (self signed certificate in certificate chain)
---
[HANGS]

and with -ssl3

openssl s_client -connect mywebsite.com:443 -ssl3

CONNECTED(00000003)
21775:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:/BuildRoot/Library/Caches/com.apple.xbs/Sources/OpenSSL098/OpenSSL098-59.40.2/src/ssl/s3_pkt.c:1145:SSL alert number 40
21775:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:/BuildRoot/Library/Caches/com.apple.xbs/Sources/OpenSSL098/OpenSSL098-59.40.2/src/ssl/s3_pkt.c:566:

and

$ nmap --script ssl-enum-ciphers -p 443 mywebsite.com

Starting Nmap 6.46 ( http://nmap.org ) at 2016-07-19 10:27 CEST
Nmap scan report for mywebsite.com (10.234.104.241)
Host is up (0.11s latency).
PORT    STATE SERVICE
443/tcp open  https
| ssl-enum-ciphers: 
|   SSLv3: No supported ciphers found
|   TLSv1.0: 
|     ciphers: 
|       TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA - strong
|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA - strong
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA - strong
|       TLS_RSA_WITH_3DES_EDE_CBC_SHA - strong
|       TLS_RSA_WITH_AES_128_CBC_SHA - strong
|       TLS_RSA_WITH_AES_256_CBC_SHA - strong
|     compressors: 
|       NULL
|   TLSv1.1: 
|     ciphers: 
|       TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA - strong
|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA - strong
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA - strong
|       TLS_RSA_WITH_3DES_EDE_CBC_SHA - strong
|       TLS_RSA_WITH_AES_128_CBC_SHA - strong
|       TLS_RSA_WITH_AES_256_CBC_SHA - strong
|     compressors: 
|       NULL
|   TLSv1.2: 
|     ciphers: 
|       TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA - strong
|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA - strong
|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 - strong
|       TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 - strong
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA - strong
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 - strong
|       TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 - strong
|       TLS_RSA_WITH_3DES_EDE_CBC_SHA - strong
|       TLS_RSA_WITH_AES_128_CBC_SHA - strong
|       TLS_RSA_WITH_AES_128_CBC_SHA256 - strong
|       TLS_RSA_WITH_AES_128_GCM_SHA256 - strong
|       TLS_RSA_WITH_AES_256_CBC_SHA - strong
|       TLS_RSA_WITH_AES_256_CBC_SHA256 - strong
|       TLS_RSA_WITH_AES_256_GCM_SHA384 - strong
|     compressors: 
|       NULL
|_  least strength: strong

Nmap done: 1 IP address (1 host up) scanned in 5.96 seconds
  • 1
    first result on google might help:stackoverflow.com/questions/7580508/… Basically chrome uses its own trust store, it can be annoying. the Certificate information being returned is invalid (hence the red on the page) check your certificates with the openssl s_client to see what is actually being returned. – LvB Jul 18 '16 at 13:20
  • I had studied that thread to avail. As soon as I click on Manage certificates, it takes me to Keychain. – zabumba Jul 18 '16 at 18:58
  • What does openssl tell you? – LvB Jul 19 '16 at 7:30
  • See UPDATE 1 in my question. Let me know if that was the right way to do it. I tried connect command – zabumba Jul 19 '16 at 8:27
  • 1
    in what store did you put your root CA? – LvB Jul 19 '16 at 9:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.