All Questions
12 questions
0
votes
0
answers
575
views
Tried 3 things to make Chrome accept remote self-signed SSL cert
I have a sandbox Windows 2016 server in the cloud that only I use for dev, testing, and experimentation. I can access the site remotely from Chrome, but no matter what I try, Chrome displays the ...
- 101
10
votes
2
answers
3k
views
Why do Chrome and Firefox report a different server certificate and issuer than OpenSSL?
When I visit https://somesite.org using Chrome or Firefox and inspect the server certificate, everything looks OK to me.
I see SSL Server Certificate, CN, O, OU that appears to match somesite.org ...
- 269
0
votes
1
answer
756
views
Why does OpenSSL show different CAs for mail.google.com:443 than what Chrome/Firefox shows? [duplicate]
Why does openssl show different certificate chain for mail.google.com:443 than what Chrome/Firefox shows?
$ openssl s_client -connect mail.google.com:443 < /dev/null | head -10
depth=2 /C=US/O=...
- 968
7
votes
1
answer
12k
views
How to add AltName from csr file to crt file using "openssl x509 -req"?
I'm a webdeveloper and want to test my websites locally with a self signed SSL certificate.
Everything was working great until a few days ago, when chrome started complaining about a missing AltName ...
- 231
9
votes
2
answers
10k
views
My site has Certificate Transparency enabled but Chrome is still showing NET::ERR_CERTIFICATE_TRANSPARENCY_REQUIRED
I have a site called www.goflyla.com and I purchased the SSL cert from RapidSSL with Certificate Transparency enabled.
SSLLabs give a green line saying Certificate Transparency: Yes (certificate):
...
- 91
5
votes
1
answer
482
views
Why do Chrome and OpenSSL disagree over signature algorithm?
$ openssl version
OpenSSL 1.0.2h 3 May 2016
$ openssl s_client -connect winkel.vpro.nl:443 < /dev/null 2>/dev/null | openssl x509 -text -in /dev/stdin | grep -i sha
Signature Algorithm: ...
- 153
4
votes
2
answers
2k
views
SSL browser session keys
I am trying to export/write the SSL master secret and keys to a file from the chromium browser. I would appreciate if someone could advice me how to do this.
To write the premaster secret we can ...
- 51
0
votes
1
answer
471
views
Do any browsers support Server Name Indication (SNI) but NOT SHA-2? [closed]
Yes, I know that SHA-2 signature validation is typically done by the operating system (with Mozilla Firefox/NSS and Chrome as of v39 being the exception).
- 207
2
votes
1
answer
5k
views
Can SHA256 signature support be deduced from TLS cipher suites or any other part of ClientHello (if no signature_algorithm sent)?
Websites aiming to maintain maximum compatibility with (legacy) browsers may wish to serve SHA2-signed certificate chains to those user agents that support them, and SHA1 to those that don't.
The TLS ...
- 207
3
votes
1
answer
10k
views
Chrome showing SSL warning about SHA-1 when the sites don't use SHA-1
My version of Chrome on an iMac (latest 43.0.2357.130 (64-bit)) is showing an SSL warning for well-known sites (Hackernews, GitHub, DigitalOcean):
This site uses a weak security configuration (SHA-...
- 1,247
0
votes
1
answer
1k
views
Google Chrome obsolete cryptography
I have a apache server running and following configuration for ssl:
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
SSLProtocol -all +TLSv1.2
SSLCompression Off
...
0
votes
2
answers
2k
views
Disabling CBC ciphers does not stop Chrome from negotiating to use CBC ciphers
I am getting an message about 'obsolete cryptography' from Chrome.
Your connection to (site) is encrypted with obsolete cryptography.
The connection is encrypted using AES_256_CBC...
Per this answer,...
- 435