4

One of our users just sent us a screenshot of them browsing our site using Chrome for OS X, version 44.0.2403.130. This came as a surprise because I thought that our certificates were up to date (via RapidSSL). I'm not 100% sure I understand the issue and am trying to figure out what we can do to fix it.

Thank you in advance

enter image description here

7

EDIT - Updated based on comments from @AdmSelec below and info from GlobalSign

Whilst usually when that error pops up it'll likely relate to SHA-1 hashing, in this case it appears more likely that it relates to a bug in Chromium on OSX (details here).

Whilst the screenshot displayed doesn't show the certificate itself it does show information on the issuing CA indicating that it uses SHA256 and usually a CA will not issue a SHA-1 signed certificate from a SHA-2 signed Intermediate.

General Answer for seeing SHA-1 cert errors

The specific concern here relates to the SHA-1 hashing algorithm that is in use as part of your certificate. SHA-1 was a commonly used algorithm for this in the past but it is now considered insecure, and modern browsers are starting to deprecate it (causing the warning your user is seeing), more information on the deprecation can be found here or here amongst others.

What you need to do is re-issue your certificate using an updated set of algorithms. The instructions will vary depending on the company issuing it, but there are some pointers here which appear to include a reference for RapidSSL.

I'd expect if you contact RapidSSL support they should also be able to help.

| improve this answer | |
  • 4
    Note that this won't get rid of the "obsolete cryptography" warning though, since the ciphersuite for the connection uses AES_256_CBC for encryption. Only the use of GCM and ChaCha20 suites can get rid of this additional error. – Xander Aug 5 '15 at 17:27
  • 1
    The asker's site already uses SHA2 certificate under SHA2 intermediate. He also clearly stated that this problem occurs on Apple OS X. This OS has a bug that causes Chrome to show SHA1 warning even in case of SHA1 root certificate: code.google.com/p/chromium/issues/detail?id=499506 How can the asker deal with an Apple's security bug by re-issuing his certificate? And this is an accepted answer! – Adm Selec Aug 6 '15 at 14:28
  • @AdmSelec if you look at the screenshot provided it clearly states "This site uses a weak security configuration (SHA-1 signatures)" and this is expanded in the rest of the screenshot to say that at least one certificate in the chain is using SHA-1. If there is a bug that would cause this well that could also be a solution, but the evidence provided indicated that it was a SHA-1 cert. issue and without the ability to see the certs in question, that seemed like a reasonable conclusion. Given the questioner accepted it, it would appear it worked for them too :) – Rory McCune Aug 6 '15 at 14:35
  • @RŠ¾ryMcCune the screenshot provided states "The identity of this website has been verified by RapidSSL SHA256 CA - G3", meaning it is SHA2 chain under "GeoTrust Global CA" SHA1 root. CAs mention signature algorithm in intermediates' Common Names not just for fun, it's an additional assurance! – Adm Selec Aug 6 '15 at 14:46
  • but, and correct my if I'm wrong here, we don't know whether the questioners certificate is signed with SHA-1 or not? I don't see that information in the screenshot – Rory McCune Aug 6 '15 at 14:48

Not the answer you're looking for? Browse other questions tagged or ask your own question.