15

I have an internal website running on SSL, but when going through it in Chrome, I don't get a padlock icon at all:

enter image description here

However, clicking it does show that the site is encrypted. There are a bunch of obvious issues - our internal CA doesn't have public audit reports and it's using old TLS, but the weird thing is that I have another server with a similar setup and there the green padlock icon shows up just fine.

I've seen troubleshooting for cases where there's a grey padlock and for cases where EV doesn't work, but neither is the case here - there is no padlock at all. I've used other browsers and tools like OpenSSL and curl and they all tell me SSL is just fine.

Before I assume this is a bug in Chrome, I wonder if there is a rule that I'm overlooking that makes Chrome behave this way intentionally?

enter image description here

Improve this question
11
  • 3rd hit from search query: inmotionhosting.com/support/website/security/ssl-lock-display
    – schroeder ♦
    Mar 13, 2015 at 0:20
  • @schroeder That shows a case where Chrome shows a grey padlock with a yellow triangle. I have found a ton of links on how to troubleshoot those. The link does not show the case where Chrome does not display a padlock at all and where SSL seems to be working perfectly fine (no mixed resources).
    – Michael Stum
    Mar 13, 2015 at 0:22
  • Compare the ciphersuite used.
    – Ángel
    Mar 13, 2015 at 0:25
  • @Ángel They are identical - AES_128_CBC, SHA1, RSA.
    – Michael Stum
    Mar 13, 2015 at 0:32
  • 3
    "Your connection to ... is encrypted with obsolete cryptography" - there you go?
    – user253751
    Mar 13, 2015 at 5:22

1 Answer 1

Reset to default
33

Your certificate only contains a sha1 signature, probably with a lifetime past 1 January 2017.

These are deprecated, and Chrome therefore removes the appearance of security. See https://googleonlinesecurity.blogspot.com/2014/09/gradually-sunsetting-sha-1.html for more info.

Improve this answer
18
  • 2
    Another reason for it to be "not padlocked" is the 'obsolete cryptography' I suggest you test your "server" with sslabs server test (gives great insight into how secure your setup is, and what to fix.
    – LvB
    Mar 13, 2015 at 9:47
  • 23
    For whom is this a bad user experience? For anyone actually using your website, displaying the padlock would give them a (false) sense of security. Proactively encouraging web masters to stop using obsolete ciphers is actually great for Chrome's users.
    – MJeffryes
    Mar 13, 2015 at 9:56
  • 9
    How is "This site is using outdated security settings" a bad experience? It tells you exactly what the problem is.
    – JamesRyan
    Mar 13, 2015 at 10:33
  • 3
    @JamesRyan No, it doesn't. The problem is the expiration date. It's okay that Chrome complains about the security setting - it's not okay that Chrome allows it on some and not on others without clearly telling why, because that makes troubleshooting it harder and makes it seem like a bug in Chrome. Clear error messages is mandatory to make stuff work, otherwise I'll just assume the browser is broken.
    – Michael Stum
    Mar 13, 2015 at 15:31
  • 2
    @MichaelStum you expect useful error messages to be considered a "usability feature"? from what I have seen, usability means obscure the error with the most generic error possible, such as to not scare off the (dumb) user
    – user2813274
    Mar 13, 2015 at 15:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .