Is Chrome Still Showing Certificate Warning for Outdated Security Settings?

  • Thread starter Thread starter Jonathan Scott
  • Start date Start date
  • Tags Tags
    Chrome
Join the discussion
Ask a follow-up here, or get your own question answered by working scientists, mathematicians and engineers — people, not an autocomplete.
Real named experts · corrections over time · the nuance an AI answer skips
Sign up Log in
15 replies · 14K views
Jonathan Scott
Gold Member
Messages
2,358
Reaction score
1,261
Chrome is giving the following warning:

The identity of this website has been verified by RapidSSL CA but it does not have public audit records.

The site is using outdated security settings that may prevent future versions of Chrome from being able to safely access it.
 
Physics news on Phys.org
The triangle warning sign comes up on the lock in the address bar, and if I click on it to see what the problem is, I see that message.
 
I'm using the dev level of Chrome, which seems to have recently updated itself: 40.0.2188.2 dev-m
 
Jonathan Scott said:
The triangle warning sign comes up on the lock in the address bar, and if I click on it to see what the problem is, I see that message.
Interesting. I'm using 38 at the moment. Do you see such an error using any other browser?
 
No warning here, with FF 32.0.2 Read the certificate file, all looks good.
 
I don't see any problem in Firefox, Opera or Safari. I think I saw some recent news item that said someone had recently demonstrated that it was possible to fake a certificate chain and that something was being tightened up in Chrome to prevent that, so it might be something to do with that. Apart from that, it could of course be a Chrome bug. I use the dev version on my personal laptop to try to get some advance warning of what they will break next in the stable version!
 
  • Like
Likes   Reactions: Greg Bernhardt
I've found the description of the change in the Chrome issues: https://code.google.com/p/chromium/issues/detail?id=401365

The title is "Deprecate SHA-1 for certificates".

I haven't fully understood it, but I think they are trying to move people off SHA-1 signing of certificates because it has been demonstrated that it can be faked, and that matches the recent news item.
 
Greg Bernhardt said:
Thanks Doug. It could be a bug in the Chrome dev release. When 40 goes to release then we can try to diagnose if the warning appears.
It's definitely a move by Google with Chrome. I received notices from Symantec for my sites at the beginning of September:

"We would like to inform you of Google's intent to phase out support for certificates using a SHA-1 hashing algorithm via degraded visual indicators and warnings in the Chrome™ browser. These changes are expected to take effect in the production version of Chrome version 39 in November 2014."

Acquiring the SSH-2 update certificates from Symantec was easy. Plan to install at Hostgator next week.

(Last month I had to diagnose a PDF issue with Chrome and found that Google had replaced Adobe PDF support with their own. Had to contact almost a dozen reps in the field because Chrome couldn't accept a date with a year earlier than 1969!)
 
  • Like
Likes   Reactions: Greg Bernhardt
FWIW, Symantec provided the SHA-2 update certs for free and provided an easy website process to acquire. Hope you're experience goes as well or better.
 
Lookin' good, Greg!

pf-cert.png
 
  • Like
Likes   Reactions: Greg Bernhardt
Greg Bernhardt said:
@Jonathan Scott do you still get the warning? The connection should be SHA-2 now.

Warning triangle has gone, thanks.
 
  • Like
Likes   Reactions: Greg Bernhardt