Skip to main content

All Questions

Tagged with
Filter by
Sorted by
Tagged with
0 votes
0 answers
575 views

Tried 3 things to make Chrome accept remote self-signed SSL cert

I have a sandbox Windows 2016 server in the cloud that only I use for dev, testing, and experimentation. I can access the site remotely from Chrome, but no matter what I try, Chrome displays the ...
0 votes
1 answer
471 views

Do any browsers support Server Name Indication (SNI) but NOT SHA-2? [closed]

Yes, I know that SHA-2 signature validation is typically done by the operating system (with Mozilla Firefox/NSS and Chrome as of v39 being the exception).
10 votes
2 answers
3k views

Why do Chrome and Firefox report a different server certificate and issuer than OpenSSL?

When I visit https://somesite.org using Chrome or Firefox and inspect the server certificate, everything looks OK to me. I see SSL Server Certificate, CN, O, OU that appears to match somesite.org ...
7 votes
1 answer
12k views

How to add AltName from csr file to crt file using "openssl x509 -req"?

I'm a webdeveloper and want to test my websites locally with a self signed SSL certificate. Everything was working great until a few days ago, when chrome started complaining about a missing AltName ...
0 votes
1 answer
756 views

Why does OpenSSL show different CAs for mail.google.com:443 than what Chrome/Firefox shows? [duplicate]

Why does openssl show different certificate chain for mail.google.com:443 than what Chrome/Firefox shows? $ openssl s_client -connect mail.google.com:443 < /dev/null | head -10 depth=2 /C=US/O=...
9 votes
2 answers
10k views

My site has Certificate Transparency enabled but Chrome is still showing NET::ERR_CERTIFICATE_TRANSPARENCY_REQUIRED

I have a site called www.goflyla.com and I purchased the SSL cert from RapidSSL with Certificate Transparency enabled. SSLLabs give a green line saying Certificate Transparency: Yes (certificate): ...
5 votes
1 answer
482 views

Why do Chrome and OpenSSL disagree over signature algorithm?

$ openssl version OpenSSL 1.0.2h 3 May 2016 $ openssl s_client -connect winkel.vpro.nl:443 < /dev/null 2>/dev/null | openssl x509 -text -in /dev/stdin | grep -i sha Signature Algorithm: ...
4 votes
2 answers
2k views

SSL browser session keys

I am trying to export/write the SSL master secret and keys to a file from the chromium browser. I would appreciate if someone could advice me how to do this. To write the premaster secret we can ...
3 votes
1 answer
10k views

Chrome showing SSL warning about SHA-1 when the sites don't use SHA-1

My version of Chrome on an iMac (latest 43.0.2357.130 (64-bit)) is showing an SSL warning for well-known sites (Hackernews, GitHub, DigitalOcean): This site uses a weak security configuration (SHA-...
2 votes
1 answer
5k views

Can SHA256 signature support be deduced from TLS cipher suites or any other part of ClientHello (if no signature_algorithm sent)?

Websites aiming to maintain maximum compatibility with (legacy) browsers may wish to serve SHA2-signed certificate chains to those user agents that support them, and SHA1 to those that don't. The TLS ...
0 votes
2 answers
2k views

Disabling CBC ciphers does not stop Chrome from negotiating to use CBC ciphers

I am getting an message about 'obsolete cryptography' from Chrome. Your connection to (site) is encrypted with obsolete cryptography. The connection is encrypted using AES_256_CBC... Per this answer,...
0 votes
1 answer
1k views

Google Chrome obsolete cryptography

I have a apache server running and following configuration for ssl: Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" SSLProtocol -all +TLSv1.2 SSLCompression Off ...