3

I followed the suggestions in this discussion for diagnosing a client-side SSL error, but I don't know how to interpret the result.

The openssl command for www.plex.tv returns a good certificate. But when I try to login at https://www.plex.tv/sign-in/ Chrome strikes out the https and shows "Not Secure." I get an error message when I proceed to login. This happens on Firefox as well as Chrome, and it happens from any computer on my home network. I am able to login from an android phone over the cellular network.

FYI I ran the SSL command on a Synology NAS which also runs on my home network.

If it was an ISP problem, wouldn't the openssl command return a bad certificate?

  • Do you get any information from the error? At first glance this looks like a MiTM that tries to serve a fake log in page with an invalid cert. – MiaoHatola Mar 16 '17 at 19:33
  • Please show what exactly you get from openssl and from the browser, i.e. output from openssl s_client and the exact error message and certificate information you get inside the browser. There are various differences in how these tools work, for example openssl s_client does not verify that the target hostname matches the certificate while the browser does. – Steffen Ullrich Mar 16 '17 at 20:01
  • From the browser, when I click the login link, the browser crosses out the https. Where it normally shows the green lock symbol with the word Secure, Chrome shows a red triangle with an exclamation point inside followed by the words "Not Secure." I don't see how to attach a screen shot, or I would. – jisner Mar 16 '17 at 22:21
  • Since hitting return ends the comment, how do I paste the openssl output? – jisner Mar 16 '17 at 22:21
  • Then (in the browser) a full page warning with a an exclamation mark in a red triangle and the heading "Your Connection is not Private" and then "Attackers might be trying to steal your information from plex.tv (for example, passwords, messages, or credit cards). NET::ERR_CERT_COMMON_NAME_INVALID" – jisner Mar 16 '17 at 22:41
2

The following steps will help you diagnose the SSL errors you receive in Chrome.

Firstly, after going to the site which generates the error, press the F12 key to bring up the Chrome DevTools. Select the Security tab item to see more about the certificate and the SSL connection:

Chrome DevTools Security tab

If there's a problem, it will be highlighted in Red. In this case, the certificate is signed with the weak, deprecated SHA-1 algorithm:

SHA-1 Certificate Error

If the error complains about the certificate in some way, you can click on View Certificate to get more information. For example, it's good to check the Certification Path to make sure the certificate appears to be legitimate:

Certificate Details

If you'd like to learn what effect the different "bad" configurations will have on Chrome, you can explore the sites from Bad SSL:

Bad SSL ain't so bad...

  • Thank you for the instructions. First let me say that the certificate problem seems to have cleared up. As mentioned above, I was able to go to www.plex.tv in an incognito window and saw a good certificate. After that, I went to www.plex.tv in a regular Chrome window and the certificate looks good there too. I did use the developer tools as you suggested. F12 shows "this page is secure." I wonder if it has anything to do with cookies, since I deleted all my Plex cookies. In any case, I still cannot login to the site, so there is another problem perhaps not related to security – jisner Mar 16 '17 at 23:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.