25

I apologise for to terseness of this question; I have an issue. Google.co.uk is failing its HSTS on my browsers.

enter image description here

Is this an issue with google.co.uk or is this just me? Is someone middle-manning my internet connection?

While I can find plenty of sites that tell me google.co.uk is working I haven't been able to establish if the HSTS issue is me or Google. I suspect it's me but would like some 3rd party confirmation.

P.S.: This appears so far just for google.co.uk, and unfortunately snuck.me doesn't seem to be working to clarify other sites' non-HSTS certificates either.


Update:

After ten minutes of being down, google.co.uk now works again, however by using snuck.me I find the following:

enter image description here

Fingerprint according to the browser:

D1:8F:DE:83:4A:68:88:32:DD:CF:C8:6B:0C:74:94:33:02:75:BC:43

finger print according to snuck.me:

42:38:CE:6C:AA:C5:FE:13:A0:5A:56:88:F3:F2:E7:E4:D7:14:07:DA

Does this confirm I have a MITM?

  • 2
    What does the presented certificate look like? – Arminius Jun 12 '17 at 19:18
  • I get the same certificate as you do. – Arminius Jun 12 '17 at 19:30
  • @Arminius shouldn't the fingerprints between the two sources match? If not, I don't get how the data can be compared if it's meant to be different? – Martin Jun 12 '17 at 19:31
  • 4
    Are you on a network with a captive portal? Sometimes they try to intercept SSL connections, with this result. – Federico Poloni Jun 13 '17 at 7:24
  • Google Switches certificates often, the external tool might have an old one cached. – eckes Jun 13 '17 at 13:45
40

Your browser rejected a certificate, but this doesn't have to be caused by an attack.

Google.co.uk is failing its HSTS on my browsers.

The warning you see doesn't indicate a problem with HSTS in particular. It's just Firefox saying: "The certificate appears invalid. And by the way, we won't let you add a manual exception because the site uses HSTS." 1

There are many plausible reasons why you got served an invalid certificate for a short amount of time. It could be a hickup at your ISP, a problem with your router, SSL interception by a captive portal (as mentioned by @FedericoPoloni) or, theoretically, a poor attempt at an MITM attack. The first step of investigation would be to check which certificate you were actually served.


Afterwards, you didn't correctly compare the certificates: You connected to www.google.co.uk but ran the third-party test against google.co.uk. These are technically different domains that serve different certificates depending on the indicated server name.

Here I'm testing each -servername with openssl and you should recognize both fingerprints:

$ openssl s_client -servername www.google.co.uk -connect www.google.co.uk:443 < /dev/null 2>/dev/null | openssl x509 -fingerprint -noout -in /dev/stdin
SHA1 Fingerprint=D1:8F:DE:83:4A:68:88:32:DD:CF:C8:6B:0C:74:94:33:02:75:BC:43
$ openssl s_client -servername google.co.uk -connect www.google.co.uk:443 < /dev/null 2>/dev/null | openssl x509 -fingerprint -noout -in /dev/stdin
SHA1 Fingerprint=42:38:CE:6C:AA:C5:FE:13:A0:5A:56:88:F3:F2:E7:E4:D7:14:07:DA

1HSTS (HTTP Strict Transport Security) is a header which web servers can send to indicate that clients should never connect to the site over plain HTTP (for a specified amount of time). Your browser picked up that header during one of your previous visits to www.google.co.uk or preloaded it. One of the header's side effects is that the UI wont't allow you to ignore certificate warnings anymore by adding an exception.

  • "It could be a hickup at your ISP, a problem with your router" - How does that work? Isn't it true that a certificate is sent by the webserver every time you make an SSL connection and providers and routers do not change the contents of a TCP stream? A problem with your ISP or router would result in a timeout instead of an insecure connection, right? – Paul Jun 13 '17 at 13:14
  • 4
    @Paul Some routers, if they can't connect to the Internet, respond with an error page similar to a captive portal to any request by a connected device. This could cause the certificate warning because the router's certificate doesn't match the one from Google. Another scenario is that the ISP can't resolve DNS queries correctly and resolves all domains to a troubleshooting site of the ISP. This would also cause a certificate mismatch. – Arminius Jun 13 '17 at 14:38
1

Check the time in your system. Sometimes​ I get this error when my clock (system time) is wrong or when a time miss synchronization happens.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.