3

My version of Chrome on an iMac (latest 43.0.2357.130 (64-bit)) is showing an SSL warning for well-known sites (Hackernews, GitHub, DigitalOcean):

This site uses a weak security configuration (SHA-1 signatures), so your connection may not be private.

enter image description here

However, when I view to the same sites on my other computer MacBook Pro, same version of Chrome and nearly identical setup, I am not getting this warning. Also, my Chrome extensions are synced to both computers, so it is not a rogue browser extension.

Any other ideas and places to look? I'm thinking it is a problem inside the keychain on my iMac.

|improve this question
  • I'm sorry, I missed those other sites being mentioned. You're right, that makes this less likely. One other thing to check would be the trusted root and intermediate certificate store on the different clients; look at the certificate chain as reported by the browser in the two cases and make sure it's the same chain. There are legitimate reasons they might differ, and perhaps one browser is using a SHA-1 signed intermediate and the other using a new SHA-2 signed cert. – gowenfawr Jul 6 '15 at 3:46
  • Is this computer on a corporate network? Maybe your connection is being MITM'd by your company using a trusted root certificate that they installed. They could be serving you a certificate they issued, instead of the one normally used by GitHub/Hacker News/etc. – Ajedi32 Jul 6 '15 at 14:42
  • 1
    I'm getting this issue to... What version of OS X are you on? I'm running 10.11 Beta, and not sure if it could be related to that. – Keverw Jul 11 '15 at 11:39
  • No, I've had the same issue with Chrome using Windows 10. Yet, on the same machine, Microsoft Edge doesn't indicate any problems. (Test site was a blog at Oracle.com) – Brian Prows Sep 12 '15 at 21:49
2

This seems to be a bug in Chrome.

Root CA Certificates are often still SHA-1 certificates, which is not a security problem (and also not considered a problem by Google: http://googleonlinesecurity.blogspot.ca/2014/09/gradually-sunsetting-sha-1.html), yet Chrome spooks users with the warning - even when the only SHA-1 certificate in the chain is the root CA certificate.

It looks like this bug only affects OS X 10.11 El Capitan: https://code.google.com/p/chromium/issues/detail?id=499506

|improve this answer
  • The recent upgrade to 44.0.2403.157 (64-bit) fixed this issue for me. I'd assume it was a bug in Chrome running on El Capitan. – Justin Aug 22 '15 at 21:04

Not the answer you're looking for? Browse other questions tagged or ask your own question.