1

I've installed a ssl certificate from https://www.startssl.com/ in a server running with plesk. The website is the following: https://refood.sal-pimenta.pt/

As you can see the certificate is fine but not that good in terms of security (sha1 and 2048 Bits key), and this fact is pointed out if you use Chrome. This is really odd because the certificate I have in my PC, the one I uploaded to the server, as sha256RSA for signature with a key of 4096 Bits.

I checked the public keys and they are obviously different, as well as the certificate CA.

Is this normal? Thanks for your time and I'm sorry if this not that related to cryptography but it seemed the right place to ask.

migrated from crypto.stackexchange.com Apr 16 '15 at 1:05

This question came from our site for software developers, mathematicians and others interested in cryptography.

2

This would have been better here.

However we can still answer your question.
I inspected the site you referred to and the reason, why chrome shows you a security warning is because the intermediate certificate of StartSSL uses SHA-1 for signature-hashing.

Your certificate is in fact SHA-256/RSA-4096 as claimed, but because one certificate in the chain (the intermediate certificate) is "weak", the whole chain is considered "weak" and hence you get a warning.

  • All the certificates in the chain (ca and intermediate) have SHA-256 when I open them in my PC. I've now compared the key and I realized that plesk changes the key because it doesn't appear to accept 4096 keys. I don't why this works because if the private key is not equal the certificate should be invalid. – NBajanca Apr 15 '15 at 22:07
0

I've found the answer for this in another post: Why is 'avast! Web/Mail Shield Root' listed as CA for google.com?

The problem was that my Antivirus that was creating it's certificate (not that secure, but irrelevant because it's between Avast and the Browser only) and making chrome say that. Everything is fine with the certificate.

Thanks for the answers and I hope this helps more people with this stupid doubt.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.