16

I have an internal website running on SSL, but when going through it in Chrome, I don't get a padlock icon at all:

enter image description here

However, clicking it does show that the site is encrypted. There are a bunch of obvious issues - our internal CA doesn't have public audit reports and it's using old TLS, but the weird thing is that I have another server with a similar setup and there the green padlock icon shows up just fine.

I've seen troubleshooting for cases where there's a grey padlock and for cases where EV doesn't work, but neither is the case here - there is no padlock at all. I've used other browsers and tools like OpenSSL and curl and they all tell me SSL is just fine.

Before I assume this is a bug in Chrome, I wonder if there is a rule that I'm overlooking that makes Chrome behave this way intentionally?

enter image description here

  • 3rd hit from search query: inmotionhosting.com/support/website/security/ssl-lock-display – schroeder Mar 13 '15 at 0:20
  • @schroeder That shows a case where Chrome shows a grey padlock with a yellow triangle. I have found a ton of links on how to troubleshoot those. The link does not show the case where Chrome does not display a padlock at all and where SSL seems to be working perfectly fine (no mixed resources). – Michael Stum Mar 13 '15 at 0:22
  • Compare the ciphersuite used. – Ángel Mar 13 '15 at 0:25
  • @Ángel They are identical - AES_128_CBC, SHA1, RSA. – Michael Stum Mar 13 '15 at 0:32
  • 3
    "Your connection to ... is encrypted with obsolete cryptography" - there you go? – immibis Mar 13 '15 at 5:22
34

Your certificate only contains a sha1 signature, probably with a lifetime past 1 January 2017.

These are deprecated, and Chrome therefore removes the appearance of security. See https://googleonlinesecurity.blogspot.com/2014/09/gradually-sunsetting-sha-1.html for more info.

  • 2
    Another reason for it to be "not padlocked" is the 'obsolete cryptography' I suggest you test your "server" with sslabs server test (gives great insight into how secure your setup is, and what to fix. – LvB Mar 13 '15 at 9:47
  • 23
    For whom is this a bad user experience? For anyone actually using your website, displaying the padlock would give them a (false) sense of security. Proactively encouraging web masters to stop using obsolete ciphers is actually great for Chrome's users. – MJeffryes Mar 13 '15 at 9:56
  • 9
    How is "This site is using outdated security settings" a bad experience? It tells you exactly what the problem is. – JamesRyan Mar 13 '15 at 10:33
  • 3
    @JamesRyan No, it doesn't. The problem is the expiration date. It's okay that Chrome complains about the security setting - it's not okay that Chrome allows it on some and not on others without clearly telling why, because that makes troubleshooting it harder and makes it seem like a bug in Chrome. Clear error messages is mandatory to make stuff work, otherwise I'll just assume the browser is broken. – Michael Stum Mar 13 '15 at 15:31
  • 2
    @MichaelStum you expect useful error messages to be considered a "usability feature"? from what I have seen, usability means obscure the error with the most generic error possible, such as to not scare off the (dumb) user – user2813274 Mar 13 '15 at 15:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.