4

Today, I visited some sites of the German DHL group.

While Chrome and Safari complain about an invalid certificate of

enter image description here

Firefox accepts it.

  • Which one is right, which one is wrong?
  • Which decision should a user trust?

This is what Safari reports:

enter image description here

To make this situation a bit more complicated, Firefox and Chrome accept the following link, but Safari complains about an invalid SSL certificate:

enter image description here

enter image description here

enter image description here

Improve this question
4
  • I was unable to replicate any issues with these sites' SSL certificates in any browser. Could this problem by unique to your machine? Stale DNS? Old CA root stores? Malware? – Ladadadada Oct 14 '13 at 22:02
  • It would help if you provided english translation of the error description. – Eugene Mayevski 'Callback Oct 15 '13 at 5:59
  • Chrome and IE use the MS list of CAs, Firefox the Mozilla list. Those lists might differ, and can also be changed by by the user/installed applications. – CodesInChaos Oct 15 '13 at 8:47
  • @EugeneMayevski'EldoSCorp It's complaining that the CA is invalid. – CodesInChaos Oct 15 '13 at 8:48
3

The screenshots show that the problem is not in the end-entity certificate (the actual server's certificate) but in the intermediate CA which issued it (the one just above): that CA is also shown with the "red cross". The error messages you see just tell you that the server's certificate cannot be used because its issuing CA is not trusted. To know why that issuing CA is not trusted, you have to click on it.

From my own systems, I see no problem with that issuing CA, and my browsers are happy with it (Firefox, Chromium on Linux; IE 8 on Windows XP). A possible reason may be a failure to obtain the CRL and/or OCSP information from the "DPWN Root", making it impossible for Safari to ascertain whether the "DPWN SSL CA" certificate was revoked or not (use of CRL and/or OCSP depends on the browser, the OS, and the configuration of both, so this may explain conflicting results).

Improve this answer
1
  • Thx! I'll do some further investigation. – SteAp Oct 15 '13 at 18:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.