2

I'm the system administrator of the site https://iris.quickfds.com. After setting a wildcard certificate *.quickfds.com for the site, I checked all main browsers.

This site is consider with no mixed content http/https onto all the workstation of my company for ie 10 or firefox 37.

With Chrome 42.0.2311.135 m (64-bit) or (32bit), the site is either with mixed/no mixed contents http/https depending of the station. I tried a full re-installation on the stations stating an unsecure site with no results.

On the stations that shows the site unsecure, we have the following information https://iris.quickfds.com/iris_chrome.png.

As google states at https://support.google.com/chrome/answer/95617?p=ui_security_indicator&rd=1, this means :

"Your connection to the site is encrypted, but Google Chrome has detected mixed content on the page. Be careful if you're entering information on this page. Mixed content can provide a loophole for someone to manipulate the page. This content could be third- party images or ads embedded on the page."

Nevertheless, this is not the case as the first page has no mixed content.

Can you help to diagnose why some stations are having this behavior and others not?

BR Christian

PS : Sorry for the first phrasing, I was in no mood to write the correct question at that time.

  • 3
    Chrome isn't giving a warning... – Nathan C May 6 '15 at 12:19
  • 1
    Chrome is indeed not giving any warnings here. Make sure you do not for example have a chrome extension installed that somehow inserts something? (Try visiting it with perhaps extensions disabled?) – user254948 May 6 '15 at 12:27
  • I have still having the issue with my workstation will all extensions disabled. – user23921 May 11 '15 at 11:41
  • Chromium doesn't give me the yellow warning icon. But if I look at connection details I see both the but does not have public audit records and encrypted with obsolete cryptography messages. The audit records message seems harmless, even Google's own site produce that. The obsolete cryptography message is the critical part. It is a quite generic warning, which AFAIK covers both the certificate chain and the algorithm negotiated between client and server. – kasperd May 11 '15 at 12:50
  • I think in your case the reason for the obsolete cryptography message is not the certificate chain, but rather the negotiated algorithm. So you need to look at which algorithms are supported by your server. In my case Chromium connects using AES_256_CBC, SHA1, and DHE_RSA. I suspect it is SHA1 which cause the warning. – kasperd May 11 '15 at 12:55
1

I finally found the reason of "unsecure comminication" which has nothing to do with mixed content.

1st, the yellow warning icon was not set for connection informatio, but for Site identity information. So the question was poorly stated

2nd, The CA store under some stations were using older CA chains that included certificate with SHA-1 signature encryption which is "obsolete" as stated by Google

https://support.google.com/chrome/answer/95617?p=ui_security_indicator&rd=1

"Google Chrome can see the site’s certificate, but the site uses a weak security setup (SHA-1 signatures), so your connection might not be private.

Proceed with caution. These are common mistakes in websites' configurations, but that doesn't guarantee that your connection is secure."

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.