10

I ordered a certificate with SHA256 from Comodo and was wondering why Chrome shows this message:

Your connection is encrypted with obsolete cryptography.

The connection is encrypted using AES_256_CBC, with SHA1 for message authentication and DHE_RSA as the key exchange mechanism.

It complains about SHA1 although the only certificate that uses SHA1 is the root certificate, which shouldn't be the problem. Why does Chrome show the warning like this?

Here is the result from the SSL Labs test (certificate information and cipher suites on the server):

Path #1

[my domain]
RSA 2048 bits (e 65537) / SHA256withRSA

COMODO RSA Domain Validation Secure Server CA
RSA 2048 bits (e 65537) / SHA384withRSA

COMODO RSA Certification Authority
RSA 4096 bits (e 65537) / SHA384withRSA

Path #2

[my domain]
RSA 2048 bits (e 65537) / SHA256withRSA

COMODO RSA Domain Validation Secure Server CA
RSA 2048 bits (e 65537) / SHA384withRSA

COMODO RSA Certification Authority
RSA 4096 bits (e 65537) / SHA384withRSA

AddTrust External CA Root
RSA 2048 bits (e 65537) / SHA1withRSA

Cipher Suites

TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
TLS_DHE_RSA_WITH_AES_256_CBC_SHA
TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
TLS_DHE_RSA_WITH_AES_128_CBC_SHA
TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA

Note: I know that AES_256_CBC isn't considered modern cryptography, so the warning about obsolete cryptography would still appear. I was just wondering about the SHA1 part.

8

The error message is just misleading

You said yourself:

I know that AES_256_CBC isn't considered modern cryptography, so the warning about obsolete cryptography would still appear.

And that is why you get that message.

Now unfortunately the message itself is not very clearly phrased.

SHA-1 is used in several circumstances. And here the "SHA-1" refers to HMAC message authentication and not to its use inside certificates.

From the Chromium TLS page (Archived here.):

Message Authentication

You may see:

“The connection is using [cipher] with SHA1 for message authentication.”

This actually means that the connection is using HMAC-SHA1 for data integrity, rather than as a certificate signing algorithm (e.g. sha1WithRSAEncryption). The HMAC construction is strong enough that it is not broken when used with SHA1 (or even MD5) as the hash function, so this is not currently deprecated.

What to do
Enable and have the server prefer a cipher suite that Chrome likes better. Namely: Something with forward secrecy and either AES-GCM or CHACHA20_POLY1305. (The TLS page recommends TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256.)

Since that is already in your list, all you have to do is change the server's preference for it.

  • 2
    Starting from Chrome 44, SHA1 will be changed to HMAC-SHA1. "The connection is encrypted using AES_256_CBC, with HMAC-SHA1 for message authentication and DHE_RSA as the key exchange mechanism." – Adm Selec Jun 2 '15 at 23:43
  • So, why does SSL Labs give an "A" and Chrome consider it an error? – Mike Wills Feb 10 '16 at 6:05
  • @MikeWills: that's weird. Should at most be a warning. Not an error. Can you share the URL? – StackzOfZtuff Feb 10 '16 at 6:37
  • I figured it out, we had one image being delivered over http. That caused the issue. – Mike Wills Feb 10 '16 at 19:01
3

Your certificate may use SHA-256, however you still have SHA-1 cipher suites enabled:

TLS_DHE_RSA_WITH_AES_256_CBC_SHA
TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA
TLS_DHE_RSA_WITH_AES_128_CBC_SHA
TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA

Disable these and the warning should go away.

Edit in response to comment:

The Chrome cipher suites are as follows:

TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305       0xCC13
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305     0xCC14
TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256  0xCC15

Cipher suites

so the strongest choice from your server would have been TLS_DHE_RSA_WITH_AES_128_GCM_SHA256. I can only think that you may have a configuration setup to prefer weaker ciphers for performance purposes?

  • But why does Chrome use it even though a better method is available? – chrisklaussner May 29 '15 at 13:43
  • 1
    @chrisklaussner: Answer updated. – SilverlightFox May 29 '15 at 14:18
  • Thank you! I accepted StackzOfZtuff's answer because of the explanation, but yours was equally helpful. :) – chrisklaussner May 29 '15 at 19:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.