All Questions
87 questions
0
votes
0
answers
575
views
Tried 3 things to make Chrome accept remote self-signed SSL cert
I have a sandbox Windows 2016 server in the cloud that only I use for dev, testing, and experimentation. I can access the site remotely from Chrome, but no matter what I try, Chrome displays the ...
- 101
0
votes
1
answer
706
views
Recent Chrome version not supporting TLS 1.3 on mac Ventura 13.1 [closed]
Almost latest version of Chrome 112.0.5615.49 (Official Build) (x86_64), on macOS Ventura 13.1, keeps negotiating TLS only up to 1.2 version. I tried some of the same websites in Waterfox (Mozilla ...
- 171
0
votes
1
answer
2k
views
How to view all SSL certificates for a website using Google Chrome?
How to view all SSL certificates for a website using Chrome? When I click the lock icon, it shows only one certificate. The Security tab shows the same - details of only one certificate. How can I see ...
0
votes
1
answer
2k
views
Skip date check in Server certificate in Chrome
We have a web application on https port with server certificate valid from 01/01/2021 and valid to 31/12/2021. Due to some constraints the clients which are going to use web application are behind ...
- 101
9
votes
2
answers
27k
views
Chrome allow insecure localhost
I have just stumbled upon what is a very helpful flag in chrome (for developers):
chrome://flags/#allow-insecure-localhost
The flag is described as:
Allow invalid certificates for resources loaded ...
- 195
31
votes
1
answer
9k
views
"google.com" is not HSTS protected?
Issue:
Oftentimes people enter google.com directly in the browser's address bar without including either the http:// or https:// prefixes.
Using Chrome DevTools on a fresh incognito session, I ran the ...
- 704
2
votes
1
answer
691
views
"Your connection is not private" for specific website, once when opening a new tab
Like many, since March, I've been working from home and using the company's VPN to do my work.
Recently, if I open a new tab in Chrome, and navigate to "news.bbc.co.uk", I got the ...
- 1,152
2
votes
0
answers
209
views
Does it matter that my browser shows an out-of-date certificate when a website uses service workers?
A website I frequent (a Discourse forum) uses Let's Encrypt TLS certificates which are updated every two months with a valid period of three months. But the certificate information shown by Chrome ...
- 371
1
vote
1
answer
594
views
Chrome: why is invalid certificate usage for resources loaded from localhost disabled?
In chrome there is a flag called: allow-insecure-localhost. As far as I can tell all it does is block localhost connection over tls if the certificate is self signed.
Why is this feature turned off ...
- 121
0
votes
2
answers
1k
views
Why does Firefox (version 71.0 (64-bit)) indicate “weak encryption” but Google Chrome (Version 79.0.3945.88) does not?
I read that Mozilla uses its own trust certificate store but does "weak encryption" have anything to do with whether the browser trusts the certificate?
Has it got anything to do with the signature ...
- 103
0
votes
1
answer
1k
views
Is it possible to browse HSTS sites over SOCKS5 proxy?
I am unable to browse HSTS websites using SOCKS5 proxy in chrome browser...getting this error...
This site can’t be reached The web page at
https://www.instagram.com/accounts/login/?hl=en might ...
- 105
1
vote
2
answers
3k
views
What does "This request does not comply with Chrome's Certificate Transparency policy." in Chrome's Security Tab mean?
When you open up Chrome's DevTools and switch to the Security Tab you'll see the message This request does not comply with Chrome's Certificate Transparency policy. on some origins. (Example: https://...
- 1,438
2
votes
1
answer
432
views
Why does my Chrome still trust Thawte certificate?
Thawte certificates are supposed to be invalid since Chrome 70, but I have Chrome 70.0.3538.102 and it accepts certificate of this site just fine. Does anyone know, why that is? Should I be worried?
- 7,858
2
votes
1
answer
195
views
Server secured with a Certificate from a Custom CA Root: OK on Firefox but KO on Chrome? [duplicate]
The Setup
In order to protect the very small intranet of the ACME company, which contains two private servers, foo-server and bar-server, I've created with OpenSSL:
The Root CA Certificate
The ...
- 123
2
votes
2
answers
11k
views
How is danger / badidea / thisisunsafe justified?
The HSTS standard states the following:
12.1. No User Recourse
Failing secure connection establishment on any warnings or errors
(per Section 8.4 ("Errors in Secure Transport Establishment"...
- 3,197
2
votes
2
answers
12k
views
HSTS doesn't work on browser when dealing with a self-signed certificate
We have a web portal and I need to add HSTS header in the response. Ours is an on-premise solution, so we use a self-signed certificate. I have added the hsts header in the response & I need to ...
34
votes
3
answers
10k
views
Does "Not Secure" mean HTTP?
I work for a corporation and we are all given a kind of employee login system whose URL goes like this in the image below. (Sorry, I cannot disclose the full URL.)
I thought "Not Secure" had ...
- 728
2
votes
2
answers
334
views
Is there a way to find the SSL certificate used for one specific browser-server SSL communication?
Chrome has a history of HTTPS sites I have accessed, I would like to know if there is somewhere Chrome would have stored details about the SSL certificate used to establish the connections to the ...
- 121
9
votes
1
answer
4k
views
Google Chrome weird random Cipher Suite
This websites gives you information on the SSL cipher suites your browser supports for securing HTTPS connections.
If you browse it with Google Chrome, you'll probably see some weird Cipher Suites in ...
- 324
6
votes
1
answer
390
views
Autofill on (untrusted) websites
Consider a website using https which presents a login form on the home page. Today I visited such a website, which I have a login and password for, and for the first time I was presented with a ...
- 161
0
votes
2
answers
1k
views
HTTPS connection issue on Chrome/Chromium/Opera
I am trying to build a light web server on an embedded device, and trying to add HTTPS to it by introducing mbedTLS.
I can use Firefox or IE to make connections without any problem.
However, when ...
2
votes
0
answers
2k
views
Does Chrome cache smartcard PIN?
When I have authenticated with a server suing TLS/SSL using HTTPS using a smartcard and PIN and I invalidate the TLS session by restarting the server, refreshing Chrome browser does not reprompt for a ...
- 131
8
votes
1
answer
6k
views
How does Google Chrome manage trusted root certificates
Unlike Mozilla Firefox, I've always assumed that Google Chrome does not come with its own certificate trust store, but uses that of the OS. At least on Windows 7 any certificate management related ...
- 265
3
votes
2
answers
17k
views
How to view all the certificates that are loaded in to Chrome or any browsers or in to the OS?
In Chrome, to view the certificate details of the site you are browsing, you can do a SHIFT+CTRL+I or navigate to: More Tools>> Developer Tools >> Security Tab.
But this will show you the details of ...
- 141
4
votes
1
answer
12k
views
Why did Chrome show my connection to Youtube as not secure?
I was browsing on Youtube a while ago, when I noticed that Chrome showed it as an insecure connection even though it was over HTTPS.
I'm using Ghostery and Adblock to block trackers but nothing more, ...
- 41
2
votes
4
answers
5k
views
Should I be concerned about Wayback Machine trying to load scripts from unauthenticated sources?
I regularly use Wayback Machine to help find archived versions of webpages that have been taken down or are other otherwise unavailable.
While using the site, I noticed a peculiar warning in Google ...
- 1,535
3
votes
1
answer
18k
views
How to force browser to trust a self-signed cert
In our Intranet. we have a site (https://site1) configured with SSL using a generated certificate for a different site URL (https://site2).
Chrome/FF/IE/Edge browsers are showing invalid certificate ...
- 151
1
vote
1
answer
502
views
Is there a way to differentiate the certificates that came as part of the certificate chain from the ones already in the trust store?
OpenSSL shows the following certificate chain for example.com:443.
$ openssl s_client -connect example.com:443 < /dev/null | head -10
depth=1 /C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert ...
- 968
1
vote
1
answer
3k
views
Burp Suite - Although my configurations are correct, still Chrome doesn't allows me to access HTTPS sites and throws an error!
I'm having a hard time accessing sites with HSTS enabled via burp proxy in Chrome. Everything works perfectly fine with Firefox and IE, but Chrome has stopped working since yesterday.
I've followed ...
- 21
3
votes
1
answer
202
views
two websites with same signing cert but google chrome says CA is invalid for one of them and not the other?
I have two websites:
[redacted]
[redacted]
When I visit the first one with Google Chrome 57.0.2987.98 I get a "ERR_CERT_AUTHORITY_INVALID" error. But the second website gives me no such ...
- 1,788
1
vote
2
answers
2k
views
Chrome doesn't see SSL certificate for main domain while sees for www
I have the following issue: Chrome browser (both desktop and mobile) shows me "Not Secure" label for my main domain "https://astrakhan.ru/" while it works OK for "https://www.astrakhan.ru/".
Firefox ...
- 11
1
vote
1
answer
151
views
What determines the type of HTTPS indicator shown by Chrome? [duplicate]
I noticed recently that Chrome 55 shows different HTTPS indicators - sometimes it shows "🔒 Secure", sometimes it indicates the company name (which, to my understanding, is associated with the HTTPS ...
- 113
1
vote
0
answers
3k
views
ERR_SSL_PROTOCOL_ERROR on a site that doesn't use SSL/TLS, on an odd port
I've set up a server running Jenkins. The web-interface doesn't have SSL/TLS support turned on by default, and I have not attempted to turn it on, and do not want to turn it on (for now at least).
...
- 490
-1
votes
1
answer
176
views
SHA-1 Certificate warning on Windows7
I have installed a clean Win7 machine on a network where my own PC is connected.
When I navigate to google.com from my PC (Win 8.1) I receive proper valid TLS connection.
Yet when I navigate to google....
8
votes
3
answers
40k
views
Chrome browser reports obsolete cipher (AES_256_CBC with HMAC-SHA1)
Jboss 6 server is configured to support these ciphers:
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
TLS_RSA_WITH_AES_256_CBC_SHA256,
TLS_RSA_WITH_AES_256_CBC_SHA,
...
- 91
1
vote
0
answers
57
views
Reason for 'Your connection is not private' on Chromium but not Chrome? [duplicate]
I get this on some, but not all ssl enabled sites.
Chromium:
Version 53.0.2785.143 Built on Ubuntu , running on Ubuntu 14.04 (64-bit)
Chrome:
Version 54.0.2840.59 (64-bit)
And here is the ...
- 145
1
vote
1
answer
747
views
How to tell my HTTPS connection to a site uses PFS?
Does the browser have a UI for displaying the details about the TLS connection to the website, besides the "secure/insecure" icon?
- 8,644
9
votes
2
answers
10k
views
My site has Certificate Transparency enabled but Chrome is still showing NET::ERR_CERTIFICATE_TRANSPARENCY_REQUIRED
I have a site called www.goflyla.com and I purchased the SSL cert from RapidSSL with Certificate Transparency enabled.
SSLLabs give a green line saying Certificate Transparency: Yes (certificate):
...
- 91
31
votes
6
answers
9k
views
Chrome: Your connection is private but someone might be able to change the look of the page
I happened to come across this (govt) website which should be HTTPS-secured, but Chrome does not show the green lock. Instead it shows this:
What does it mean? How can attackers leverage this ...
- 1,144
0
votes
0
answers
555
views
How to install client certificates globally for Google Chrome in Ubuntu?
I am trying to install a client certificate to Google Chrome running on Ubuntu. I want any user who logs in to Ubuntu to be able to use this client certificate in Chrome.
Even better if I can create ...
- 393
1
vote
1
answer
3k
views
How to access an HTTPS service running deprecated technology? (TLS 1.0) (phone works but not PC)
So this is the issue: I have a modem/router provided by my telco.
The router exposes the usual 192.168.1.254 address for managment, but with my pc there's no way to open it, I tried with firefox, ...
- 13
5
votes
1
answer
482
views
Why do Chrome and OpenSSL disagree over signature algorithm?
$ openssl version
OpenSSL 1.0.2h 3 May 2016
$ openssl s_client -connect winkel.vpro.nl:443 < /dev/null 2>/dev/null | openssl x509 -text -in /dev/stdin | grep -i sha
Signature Algorithm: ...
- 153
7
votes
2
answers
12k
views
Why is CAcert not trusted by my browser?
I am fairly new to encryption and SSL. Today I googled a bit (read some atricles about security) and encountered the site
https://cacert.org. I clicked it and was surprised. Chrome showed me a "not ...
- 1,072
43
votes
1
answer
76k
views
Chrome >50: Where can I see the negotiated cipher suite?
This is about Chrome 50 and later. When visiting an https site, where can I find the negotiated cipher suite?
I know where to find this info in previous versions of Chrome but I'm not able to find it ...
- 1,438
4
votes
2
answers
2k
views
SSL browser session keys
I am trying to export/write the SSL master secret and keys to a file from the chromium browser. I would appreciate if someone could advice me how to do this.
To write the premaster secret we can ...
- 51
13
votes
2
answers
4k
views
Google Chrome says "Your connection to example.com is encrypted using an obsolete cipher suite."
I get following info when I click on lock icon on address bar:
I have couple of questions:
Q1. What are the security concerns here?
Q2. Even after 'obsolete cipher suit' message, Chrome is able to ...
- 233
4
votes
1
answer
2k
views
Firefox & Chrome Strong Ciphers
Of the following ciphers for RSA authentication, Firefox and Chrome do not use stronger than ECDHE-RSA-AES128-SHA256.
ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(256) Mac=AEAD
...
- 1,813
6
votes
2
answers
2k
views
Chrome: Watch for modified https-certificates
I read a lot about security of https and possible MITM attacks lately.
For me it seems there is only possible way to make a https-MITM attack: When a MITM exchanges the shipped https-certificate and ...
- 861
4
votes
1
answer
930
views
OneDrive marked unsafe by Google Chrome due to unsafe scripts
The OneDrive user's drive page asks to load the following script (which is typically blocked by Chrome to be unsafe)
<html>
<head>
<title>Bing</title>
</head>
<...
- 143
19
votes
3
answers
5k
views
Why do Firefox and Chrome "leak" critical security information out of the browser and how can I stop it?
In studying SSL / TLS handshakes and encryption, I found a method that describes how to export the SSL / TLS session keys from Firefox to an user or environmental variable outside the browser, and ...
- 2,052