0

I got

This website doesn't supply identity information

in firefox while browsing gmail.com, I understand that would be because I understand it is required when it needs to load content using HTTP and HTTPS as explained in this post

however when I check most possible scenario to make gmail load contents (from attachment, from profile pictures, loading mails, loading ads, gtalk embedded voice call, hangout), everything is transferred over HTTPS, no HTTP is used

now if I check the fingerprint supplied via the site consumed by Firefox it is

enter image description here

and when I check the identity by using https://www.grc.com/fingerprints.htm, I get different fingerprint

enter image description here

is my understanding correct ? if so why do I see different finger print ?

1

The page on GRC actually explains why this occurs. Google has a massive infrastructure, and uses many certificates to protect HTTPS traffic, not just one. Each of these certificate has a different fingerprint, of course. So, even though you see two fingerprints above (because there are two different certificates here, one was used when you access the site, and a different one when GRC accessed it) both are valid Google certificates. This behavior is as expected.

  • Thank you, how can I make sure the fingerprint I have is one of their's actually ?/ – Jigar Joshi Feb 24 '15 at 0:20
  • 2
    @JigarJoshi Look at the certificate chain. If the root is a GeoTrust cert, and the intermediate cert is a Google signing cert, then it's one of theirs. – Xander Feb 24 '15 at 0:50
  • Thanks!, @Xander How would this work with DANE ? – Jigar Joshi May 1 '15 at 7:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.