0

We have a site that uses a signed cert from thwarte and we have an A rating for the cert across multiple checking tools.

However, we have a user that complained that her browser does not trust the cert.

I explained to my boss, that it is most likely that the user has a browser that

  1. does not have a full list of CA certs.
  2. OR her system & browser is not up to date.
  3. is compromised in some way.

Am I secure in saying this? I'm stressing because it is a big client, but I can say 100% that the cert is installed, valid and accepted under a large scope of tests.

I just need a sanity check, is there anything else I could be missing?

8
  • 1
    Are the date and time correct on this persons computer? – joeqwerty Jan 25 '16 at 14:46
  • 1
    Also, why not give us the URL of the site? Is it a public facing website? – joeqwerty Jan 25 '16 at 14:47
  • 1
    Their browser should indicate the reason it's believed to be invalid. I'd walk the user through proving you the details needed to troubleshoot - how to screenshot the error, how to bring up the certificate details, etc. Maybe they're seeing an antivirus software's intermediate cert or something. – ceejayoz Jan 25 '16 at 14:47
  • @joeqwerty I am not sure, but I have heard of this before as well. I'll add it to their to do list. – user1658296 Jan 25 '16 at 14:47
  • 2
    Check the URL SSLLabs and look or missing chain certificates (i.e. "Download required"). – Steffen Ullrich Jan 25 '16 at 14:58
2

Browsers can build up cert links back to a CA in funny ways.

Normally your server will supply the site cert, and an intermediate cert and most browsers should be able to chain that intermediate back to a CA it has in its trust store.

There are a few gotchas to be aware of though that are not covered in the scenarios in your question:

  1. If there are multiple paths from cert to CA then browser may choose a different path if it already has a path in its cache (e.g. If a visitor visited another website with cert also issued by Thwate). In this case it can even ignore the intermediate cert your server returns as it thinks it's got a better path. This has caused problems with the Sha-1 to Sha-256 upgrade as a Sha-1 intermediate is used when it shouldn't be for example if CA reissued intermediate certs in Sha-256 format without creating an independent cert. You need a screenshot of the cert path to be sure of this.

  2. I've seen issues with Chrome recently failing to validate EV certs behind proxy servers as it cannot check Revocation status (which is required for EV certs). This results in a red HTTPS symbol in address bar but doesn't explain why :-( Latest version of Chrome gives a Security tab in developer tools which explains this. Note sure why this is but appears to be a bug in Chrome when used behind a proxy. Ask if it's a problem just for Chrome and if so ask for a screenshot of the Developer Tools->Security tab. https://www.thwate.com is currently showing red on my company PC for this reason ironically enough!

  3. Could be MITMing your connection (again common in corporate envs). This involves replacing your cert with a dummy local one which might have an issue. A screenshot of cert chain should help here as well.

  4. Is it definitely a cert error? And not a red HTTPS symbol for some other reason (e.g. Insecure content)? The browser affected and version might help debug this (e.g. If loading extra libraries for old version of IE over http accidentally and you haven't tested that yourself in a while).

That's all I can think off for now.

2
  • thanks this is excellent. It definitely a Cert error that says the cert authority is invalid. What I am most interested in now, is if this is something that the user needs to sort out on their own since our offering is up to the required industry security standard. – user1658296 Jan 25 '16 at 20:26
  • Sadly I often find it doesn't matter - especially for "big clients" ;-) – Barry Pollard Jan 25 '16 at 20:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.