- Typical browsing to www.BankOfAmerica.com got me an ERR_CERT_AUTHORITY_INVALID error. This was with an up-to-date production version of Google Chrome for Mac.
- I tried with Safari, and got the same result.
- The certificate is good until 2016, so it doesn't appear to be an expiration issue.
- It appears that the authority Symantec Class 3 EV SSL CA - G3 is deemed invalid. Trying to browse to twitter.com as well as https://my.symantec.com, brings up the same warning. HTTPS connections to other sites (with GeoTrust, Google and other CAs) work fine.
- OTOH, running an SSL checker tool (at sslshopper.com) shows that everything is in order.
Can you reproduce the above behavior? Do you get SSL warnings in your browser(s) at sites like bankofamerica.com and twitter?
Can you explain what is happening?
As for my level of expertise, note that I'm not a dev but an end-user.
Update: - Mac OS X browsers get the trusted root CAs from the OS, and this started right after I installed an Apple security update. So confirming the behavior would likely require OS X 10.8.5 with latest security patches.
The mistrust starts with the root CA, "VeriSign Class 3 Public Primary Certification Authority - G5". I can see that a CA with this exact name appears in the OS (Mac's "Keychain" database) as a valid and trusted cert, but its serial number (and therefore SHA-1 and MD5 fingerprints) are completely different form what the browsers see.
I wonder, therefore, if Apple's latest security patch broke a good chunk of the web. Ironically, it also broke Apple's OS Software Update because they also rely on VeriSign. I'll sniff around the Apple forums, too.
It's worth noting that Chrome says both "the certificate is not trusted" and "your connection is encrypted with obsolete cryptography".
This isn't what I was planning to do on Sunday morning... but AFAIK the easiest way to break SSL/TLS is for me as a user to say "eh, I'll just add this CA". When it has to do with my bank and a third of the web, I proceed with caution.