1

I have the Certificate Patrol addon (website) installed in Firefox. While I mostly ignore the (far too many) warnings, today I saw that the certificate authority for my personal website has changed. This certificate is created by myself, self signed, and I didn't change anything for the past month or two.

I made a screenshot of the warning, and see two different SHA1 fingerprints. MD5 fingerprint changed from - to undefined. Organization name (O) changed as well from unknown to the name I gave it. I didn't click the "view certificate" buttons for both websites, and regret that now.

  • What does this mean? Can I trust the certificate?
  • How can I check that my certificate is still valid, created by me, not changed by someone or something else?
  • Should I recreate it?
  • 1
    Is this a self signed cert? – StackzOfZtuff Jun 20 '15 at 19:41
  • Yes, it is self signed. – SPRBRN Jun 20 '15 at 19:44
  • 2
    What does your website do, and what does it run on? Some software packages I've seen automatically generate their own self-signed certs every once in awhile, though most come with a default cert that everyone with the package gets to start with, unfortunately. – Anti-weakpasswords Jun 21 '15 at 0:14
  • The certificate is created by openssl, and is used by Tomcat 7 on a Ubuntu 14.04 server. I see that the validity period is only three months. I created it one month ago, in two months it's not valid anymore. I thought it would last longer, but apparently I didn't set that right. – SPRBRN Jun 21 '15 at 9:57
3

What does this mean?

The certificate changed, as shown by the different SHA1 hashes. The MD5 hash field is no longer relevant as Firefox deprecated them.

Can I trust the certificate?

No, if it changed without the admin (ie. your) intervention, you should be highly suspicious.

How can I check that my certificate is still valid, created by me, not changed by someone or something else?

You should compare the new certificate with the copy/hash you kept locally when creating it. Because you wrote it down, right?

Should I recreate it?

Not necessarily. If your certificate were compromised, it wouldn't have been detectable. OTOH, if you're not sure which certificate you created, generating a new one would be appropiate.

.

Although this shows that there was a man-in-the-middle attack on you/your website, probably the new (forged) certificate was generated by a captive portal or even your router, and not someone targetting you at the network level.

  • Thanks for the explanation. The key was created one month ago, and is two more months valid. I may have entered a wrong date, but normally I would use a certificate that is valid for at least a year. I'm going to recreate it, and then write the hash down, and be more alert about it. – SPRBRN Jun 21 '15 at 10:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.