7

We utilize HTTPS deep packet inspection in our firewall via a trusted root certificate in the Windows certificate store. Chrome recently pushed forward with a feature to perform additional checks on certificate issuance called Certificate Transparency, where each certificate used (that was issued after a certain date) is checked against a known good list of CAs.

The use of HTTPS deep packet inspection (aka HTTPS proxying/offloading/MiTM) now causes Chrome to error as per this example.

Is it possible to disable the sole feature of audit log checking in Chrome?

Update in response to womble's answer.

This update is wrong. Womble's answer is correct, see below.

This is what I originally thought, but it clearly isn't.

Here are screenshots of overly righteous Chrome:

No MiTM:

no mitm

MiTM:

mitm

It does appear that it is directly related to cert transparency/audit log checking and not the use of SHA-1 and upcoming depreciation in nanny Chrome. Worth noting that our internal CA cert does expire after 2017.

Update 2, womble is right:

Thanks to womble's answer, I re-reviewed the notice from the Chrome team, and noticed any site with a cert with an expiration 2017+ that uses SHA-1 will get the "affirmatively insecure" warning (the crossed out red lock icon).

To prove my MiTM/proxy the culprit, I used a salesforce test site (located via ducking a KB article)

No MiTM:

enter image description here

MiTM:

enter image description here

 *note that even with no MiTM Chrome detects this site as "secure, but with minor errors" (that yellow icon) because the cert expires within the 2016 calendar year, not 2017+.

My proxy/MiTM is downgrading the algo from SHA-256 to SHA-1. Tsk Tsk! Chrome is acting exactly as intended according to the notice, and I do not believe my user's will receive "affirmatively insecure" notifications once I resolve this issue with the MiTM/proxy.

Thanks!

Update 3: Remember to check firmware updates/release notes... SHA-256 now supported. Update slated Friday. Should be a-okay.

Improve this question
2
  • 3
    I don't think you can disable it, but you can specify a custom log key with the --certificate-transparency-log flag. --ignore-certificate-errors is not an option because it will disable any security checks for certificates, not just CT.
    – Léo Lam
    Jul 3, 2015 at 19:55
  • You are correct here as well. This is what I was reading, but it said nothing about creating the affirmatively insecure notice. I'll have to check if it would produce the secure, but with minor errors notice. Thank you!
    – brandeded
    Jul 7, 2015 at 18:19

1 Answer 1

Reset to default
6
+100

Assuming that the example you're pointing to is actually the one about "The site is using outdated security settings", and not "does not have public audit records", about 99.99% sure that your problem isn't CT, for several reasons:

  • It is my understanding that only CA certificates in the system trust store are subject to CT validation; locally-managed CA certificates don't require CT treatment (for pretty much exactly the reason you've got).
  • Failing CT validation only matters for EV certificates at the present time, and the only negative impact is that the certificate loses the EV "green bar" treatment.

The error about "using outdated security settings" actually means that your MitM proxy is issuing SHA-1-based certificates with expiry dates in the far future, which probably isn't such a winning idea.

Improve this answer
3
  • This is originally what I thought, but as this post is in complement and not answered by the linked to thread, it is not the cause. I've updated the original question, providing screenshots. It's a UX thing I'm focused on... it's tough to explain to our legal team the intricacies of encryption use in Chrome when the GC gets this error on their Belkin GPS site (just a minor example). Granted firefox has it's own cert store, this type of problem is avoided by adding the CA to the trusted CA store. Chrome relies on Windows cert store... apparently barely.
    – brandeded
    Jul 7, 2015 at 14:15
  • womble: please edit your answer so that I can re-upvote you. My mistake, you are absolutely correct.
    – brandeded
    Jul 7, 2015 at 16:46
  • This reminds me of this answer… The Chrome message is probably a bit too confusing!
    – Léo Lam
    Jul 8, 2015 at 23:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.