1

While not particularly knowledgeable on public key infrastructure, I've noticed strange issues with SSL and TLS lately that I'm unable to diagnose. As these issues have currently left me dumbfounded I'm hoping someone more knowledgeable may provide input.

On my "home network" I have a consumer router with up to date firmware, and a similar modem. There are different machines on the network running different operating systems, some relatively trusted, and some that could be assumed to be malicious.

The integrity of the router itself is suspect but not nearly as suspect as the other machines on the LAN.

Occasionally, but now once or more per day when visiting websites I find that the browser throws a warning page to the effect of "This site does not support HTTPS". If I override to continue to the HTTP site, the site goes on to load securely all of the sudden. Similarly, when manually reloading the page after receiving the HTTP warning, the site goes on to load with SSL or TLS.

This behavior has been observed on several of my machines with a few different browsers, and I'm forced to reload pages to get a secure connection quite a bit.

When I do end up with a secure connection after refreshing, the certificate fingerprint reported by the browser seems to match that of the certificate obtained via tor on a relatively trusted machine.

Interestingly, my roommate who works in a separate building on a different network has noticed the same issue, albeit less frequently (as he says), and on a different machine which never moves between buildings as well.

At this point I should also note that I am a journalist and have reason to believe I may be targeted by government interests.

Given that the certificate fingerprints always match is there cause for concern?

What sort of tests should I go about conducting to see what causes the brief security downgrades?

If something like NTP is briefly off, could that cause these issues?

0

1 Answer 1

1

With what you said can't exclude a small outage on the website you are trying to visit, especially with the site loading in HTTPS (redirection from the HTTP site after you click the pass through dialog) right after the initial failure and with the certificate matching.

1
  • Google outages make the news, so can be safely excluded. Your best bet is to capture traces that permit debugging the issue further. Ideally you'd run wireshark and save the timeframe of the incident that could help debug further. curl (curl.se/download.html) in debug mode (curl -v google.com) could also help if it could capture one of the events. Oct 17, 2022 at 12:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .