3

We've recently acquired a new .Care domain and are attempting to install a SSL certificate. Whilst FF and IE are perfectly happy with the certificate - both display the padlock, Chrome is not and displays the following:

"The identity of this website has not been verified. The identity of the server you are connected to cannot be fully validated. You are connected to a server using a name only valid within your network, which an external certificate authority has no way to validate ownership of. As some certificate authorities will issue certificates for these names regardless, there is no way to ensure you are connected to the intended website and not an attacker."

The cert chains are valid, and after some digging, it appears the source of this is the way that Chrome interprets TLDs and any that it doesn't recognise, treats as non-unique.

Have we done something wrong in the way we have installed the cert? Is this a bug in Chrome? If so is there a workaround?

  • 3
    Sounds like a bug in Chrome to me. – Michael Hampton Sep 11 '14 at 12:25
  • @MichaelHampton Thanks, I was afraid of that, I was hoping it was something we'd done wrong - at least that would have been easier to fix! – SWa Sep 11 '14 at 12:28
  • Please link to the bug report you filed. – Michael Hampton Sep 14 '14 at 16:24
  • 1
    What is the actual domain name? – Joe Sniderman Sep 14 '14 at 20:19
  • 1
    I can confirm this with Chromium 34.0.1847.116 on Linux i686. It says nothing more than 'The identity of this website has not been verified.'. Probably a bug that has been fixed in 35? And please turn off SLL2, and the insecure Client-Initiated Renegotiation, both have known sec issues. – sebix Sep 15 '14 at 18:23
6
+50

This is a bug in Chrome. You can see in the code that Chrome maintains a list of registry controlled domains and that it needs updated as each gTLD is added.

You can see in the effective_tld_names.dat file that the .care domain is not listed, though its listed for other browsers that use a more recent version of the Public Suffix List.

This is what causes Chrome to believe your domain is not unique, it thinks its not controlled by a registrar, which means anyone could use it.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.