As far as I can tell (ssllabs.com / ssldecoder.org) the certificate for www.sarahah.com has been revoked:

Serial  C1:18:2F:1A:91:A9:0E:03

CRL - Revoked on CRL: http://crl.godaddy.com/gdig2s1-792.crl
Revocation date: Mar 1 18:19:00 2018 GMT

OCSP    - REVOKED: http://ocsp.godaddy.com/
Revocation Time: Mar 1 18:19:00 2018 GMT
Revocation Reason: cessationOfOperation

This shows as SEC_ERROR_REVOKED_CERTIFICATE in Firefox 58.0.2, as it should.

However Chrome 64 seems to be perfectly happy with it! Any idea what's going on?

Obviously the hostname resolves to multiple IPs, but behaviour seems consistent in Firefox and Chrome with multiple refreshes.

Chrome 64 screenshot


While Firefox uses OCSP to check for revocation Google Chrome uses CRLsets which include only revocations which are considered to be important by the project - which sadly does not include all revoked certificates. And the site you have visited does not seem to be important enough to be included in the CRLsets.

For a deeper discussion about this problem see An Evaluation of the Effectiveness of Chrome's CRLSets (2014), Revocation checking and Chrome's CRL (2012) or SSL certificate revocation and how it is broken in practice (2018).

  • Interesting. Not that I care about the site, but the Alexa rank is 3,465, and 107th in Egypt for some reason. But the docs say "Only entries that have no reason code, or one of the following reason codes are included in the CRLSet: Unspecified, KeyCompromise, CACompromise or AACompromise." So the explicit reason above would exclude this revocation. – Oli Mar 4 '18 at 17:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.