3

I have two websites:

  1. https://www.pap360.com/
  2. https://www.scbn.org/

When I visit the first one with Google Chrome 57.0.2987.98 I get a "ERR_CERT_AUTHORITY_INVALID" error. But the second website gives me no such error.

I exported the top level CA cert in the cert hierarchy and did a binary comparison between the two. They're the same certs. So why am I getting this error?

The first site is using a wildcard domain. Is that the issue?

  • If you visited the website using the raw IP address like "23.253.244.32",urltURL would not match the domain name in the certificate, and the browser will complain about that – Ubaidah Mar 14 '17 at 21:42
  • Although I don't get the cert error, The first site loads a JS in cleartext, thus may be displaying data in mixed mode (though chrome prevents it). – ndrix Mar 14 '17 at 21:49
4

StartCom certificates are no longer trusted by Chrome, due to a number of irregularities found in WoSign (the parent company of StartCom) and StartCom's certificate issuance practices. There is a blanket policy of distrusting all certificates issued by WoSign or StartCom after October 21st, 2016, but due to a requirement for certificate transparency and other unspecified technical reasons, certificates issues before this date may not be trusted either. Since the certificates for both of the sites you referenced were issued before this date, it appears that one of them meets Google's criteria to remain trusted, while the other does not, for indeterminate reasons.

You can read more about Google's decision to stop trusting certs signed by these roots here.

  • 1
    beat me to it try openssl s_client -showcerts -connect www.scbn.com:443 if you want more info about the cert – MikeSchem Mar 14 '17 at 22:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.