All Questions
87 questions
0
votes
1
answer
471
views
Do any browsers support Server Name Indication (SNI) but NOT SHA-2? [closed]
Yes, I know that SHA-2 signature validation is typically done by the operating system (with Mozilla Firefox/NSS and Chrome as of v39 being the exception).
- 207
2
votes
1
answer
409
views
Chrome/FF not negotiating advanced ciphers?
Ran into a weird problem trying to lock down our AWS ELBs today, specifically trying to deprecate all support for SHA-1.
Having removed options like AES256-SHA ECDHE-RSA-AES256-SHA (among others) ...
- 41
0
votes
0
answers
43
views
Security implications of an "obsolete" cipher as indicated by Chrome [duplicate]
I guess this has been asked before, but what are the security implications of the below message? I've seen ciphers such as AES_128_GCM being labeled as "modern". Is this mitigated server side (load ...
anon
21
votes
1
answer
25k
views
Why is secp521r1 no longer supported in Chrome, others?
Found a few issue threads, notably for Chrome (Chromium issue #478225), and the browser does appear to have dropped support for the secp521r1 curve (can test your browser using SSLLabs). There were ...
- 2,412
2
votes
1
answer
5k
views
Can SHA256 signature support be deduced from TLS cipher suites or any other part of ClientHello (if no signature_algorithm sent)?
Websites aiming to maintain maximum compatibility with (legacy) browsers may wish to serve SHA2-signed certificate chains to those user agents that support them, and SHA1 to those that don't.
The TLS ...
- 207
3
votes
1
answer
463
views
Getting a certificate warning for one email but not another
When I log into outlook.com using Chrome browser, I get a certificate warning for one account but not another. One says my connection is private, the other says it "may not be private".
Here are the ...
- 133
1
vote
2
answers
401
views
Should I update my SHA-1 certificates? If so, how?
Q: Should I update my SHA-1 certificates? If so, how?
Recently I noticed the "https:" has a red strike-through and warning in Chrome, but only on certain websites. Apparently this has been ...
- 171
3
votes
1
answer
10k
views
Chrome showing SSL warning about SHA-1 when the sites don't use SHA-1
My version of Chrome on an iMac (latest 43.0.2357.130 (64-bit)) is showing an SSL warning for well-known sites (Hackernews, GitHub, DigitalOcean):
This site uses a weak security configuration (SHA-...
- 1,247
11
votes
2
answers
27k
views
Obsolete cryptography (SHA1) warning although certificate uses SHA256
I ordered a certificate with SHA256 from Comodo and was wondering why Chrome shows this message:
Your connection is encrypted with obsolete cryptography.
The connection is encrypted using AES_256_CBC,...
- 223
18
votes
2
answers
8k
views
Securing Google Chrome Browser against the Logjam exploit on Windows
Is there a way to fix Chrome against the Logjam TLS exploit on Windows? I have updated my Chrome to the latest version yet the https://weakdh.org/ website warns me that "web browser is vulnerable to ...
- 1,023
4
votes
1
answer
1k
views
Different SSL cert behavior with Chrome on desktop vs. Chrome on iOS
We have a website, https://uk.care.com, that has a GeoTrust multi-SAN cert on it. The cert is up-to-date, using SHA-256, TLS 1.2, etc. When we view the site in Chrome on various desktop systems it ...
- 143
11
votes
1
answer
4k
views
Distinguish between Wi-Fi Captive portal and MitM attack
Not sure whether this should be asked in Super User or here.
How does Chrome distinguish between a Wi-Fi access point intercepting with a captive portal and a man-in-the-middle attack on HTTPS?
Are ...
- 2,299
0
votes
1
answer
156
views
MitM Chrome Mobile
I just came across the issue about MitM on Opera/Nokia browser 2013. I know, this is an "old" problem, but it seems very interesting to me.
I was wondering how Chrome on mobile handles the SSL ...
- 163
16
votes
3
answers
163k
views
HTTPS icon red and crossed out - Chrome browser
What does it actually mean when the HTTPS icon is red and crossed out in Chrome?
Does this mean that the site is vulnerable to a Man in the Middle Attack? Is it safe or not?
- 1,590
12
votes
1
answer
9k
views
TLS 39 month certificate limit and Chrome's NET::ERR_CERT_VALIDITY_TOO_LONG error
Late last year the CA/Browser Forum decided to limit the maximum valid term of TLS/SSL certificates issued after 1 April 2015. After this time, as the official guidelines put it..
CAs SHALL NOT ...
- 223
4
votes
3
answers
20k
views
Chrome showing cryptography as 'obsolete' [duplicate]
Similar to this question, Chrome is showing the connection cryptography as obsolete. Opera, IE and Firefox seem perfectly fine with the connection.
My guess would be the message authentication is ...
- 157
0
votes
1
answer
411
views
Audio not playing on Android (Kitkat 4.4.2 on LG G Pro 2 D838) via HTTPS [closed]
I am having issues playing an audio file on the chrome browser!
This audio file plays on the chrome browser on my mobile LG G Pro-2(D838) running Kitkat 4.4.2 without any issues.
But when i uploaded ...
- 103
2
votes
2
answers
203
views
Browser Updated, yet still vulnerable to POODLE
So here's a situation, some of my company's partners notified us that they will be entirely disable their server's SSLv3 support.
This prompts my superior to take this chance to update our operation ...
- 21
15
votes
1
answer
12k
views
Why would Chrome not display a padlock icon at all on an SSL site?
I have an internal website running on SSL, but when going through it in Chrome, I don't get a padlock icon at all:
However, clicking it does show that the site is encrypted. There are a bunch of ...
- 411
0
votes
3
answers
358
views
Type of SSL connection used when visiting google services
I have 2 computers running chrome:
a) Win 8 , latest chrome
b) Win 7 , latest chrome ~ 1.5 yr old high spec laptop
Both display the Certificate Authority as: Google Internet Authority G2
computer ...
- 23
0
votes
1
answer
272
views
Is my sha1 SSL cert safe if they expire before 2016?
According to the Google [1], if my SSL cert expire after 2016 and at some points they will show a warning.
But, if all my cert expired before 2016, so I assume no action need to be taken to prevent ...
- 507
4
votes
3
answers
9k
views
Invalid OCSP signing certificate in OCSP response
I want to open the following page in Firefox, and get an error.
https://www.acm.nl/nl/
Secure Connection Failed
An error occurred during a connection to www.acm.nl.
Invalid OCSP signing ...
- 7,569
-3
votes
2
answers
979
views
Is "HTTPS" ~100% secure? [duplicate]
Assuming that we have a "green bar connection" to a website, e.g.:
Is an attacker still able to sniff our traffic?
How secure is a user from man-in-the-middle attacks when he has established a "...
- 3,343
4
votes
2
answers
2k
views
What is the difference between EV-SSL certificates and Normal SSL certificates? [duplicate]
Recently while looking at several banking URLs I can see the domain name with security certificate at address bar and normal locker security certificate at address bar. Have a look at the screenshots:
...
- 5,147
1
vote
1
answer
2k
views
How to force browsers to accepte all further SSL certificates
I am using the last versions of IE, Firefox and Google Chrome web browsers on Windows 8. How can force these browsers to accept automatically the SSL certificates of any website I will visit ?
I know ...
user52672
0
votes
5
answers
11k
views
I see a warning notification "site not verified"
Utill yesterday I never saw any warnings on secure sites like twitter and many others but currently I am getting an exclamation in my chrome saying identity not verified but https is indeed used, ...
- 119
8
votes
2
answers
5k
views
Is Google Chrome Extension access to SSL certificate validation output possible?
I want to develop an extension which will stop an user from proceeding to any banking site (configurable by user) if a proxy like paros is seating in between sending fake certificate to user. My ...
- 1,507
1
vote
2
answers
3k
views
Self-signed SSL certificate on chromebook (and android)
I am having the following problem on both my android phone and on my chromebook. I'm running a website on an internal server (10.3.3.3) using nginx with a self-signed ssl certificate. Since it is just ...
- 2,847
28
votes
4
answers
21k
views
What Trusted Root Certification Authorities should I trust? [duplicate]
After two recent Slashdot articles (#1 #2) about questionable Root Certificates installed on machines, I decided to take a closer look at what I have installed on my machines.
(I use current versions ...
- 383
7
votes
2
answers
2k
views
How is HTTPS Everywhere leaking my Twitter session from an incognito window?
I manage a couple of twitter accounts for businesses/websites that are separate from my personal account. For simplicity, I prefer to log in from an incognito window so that I don't need to log out of ...
- 223
5
votes
1
answer
4k
views
Different SSL states as seen by Safari, Chrome and Firefox
Today, I visited some sites of the German DHL group.
While Chrome and Safari complain about an invalid certificate of
Firefox accepts it.
Which one is right, which one is wrong?
Which decision ...
- 315
3
votes
1
answer
1k
views
Chrome torn down the TLS connection after received server ChangeCipherSpec
I met a strange issue that the TLS connection is always torn down by Chrome after received server ChangeCipherSpec. The sequence is as following:
Client Server
SYN--> ...
- 31
18
votes
4
answers
29k
views
Remove RC4 from SSL/TLS ciphers in Chromium
Recently I started to live without RC4 within my Firefox session. Discussion about it can be found here. While it is quite easy in Firefox (Enter about:config and then rc4), I found no possibility to ...
- 1,701
9
votes
3
answers
17k
views
Chrome does not show green bar with EV SSL but firefox and IE does
I just installed a EV SSL certificate on my server. It has been done correctly and is working, the issue is that Chrome does not show the company name in the green address bar, just shows the green ...
- 91
11
votes
4
answers
12k
views
Man-in-the-middle Blue Coat proxy SSL or what?
I have just discovered that my workplace has enabled some new features in the Blue Coat network proxy. It seems like all HTTPS certificates in Chrome on Windows are being issued by this internal ...
- 123
0
votes
2
answers
337
views
Can IE be made to imitate the behavior of Chrome's KeyGen element?
Is there any way I can repurpose existing ActiveX controls or functionality to get IE to work with the KeyGen element?
Assistance getting Safari to work with this optional HTML5 spec would be ...
- 51.1k
3
votes
2
answers
3k
views
Do most browsers handle mixed encrypted and unencrypted content correctly?
In Google Chrome, when I go to an encrypted page that contains unencrypted content, I get the following pop-down, which allows me to either load or not load the insecure content, making a clear ...
- 445