Is Chrome Still Showing Certificate Warning for Outdated Security Settings?

[Jonathan Scott]

Chrome is giving the following warning:

The identity of this website has been verified by RapidSSL CA but it does not have public audit records.

The site is using outdated security settings that may prevent future versions of Chrome from being able to safely access it.

 

[Greg Bernhardt]

How is that message being presented? I am using the latest Chrome and only see that text if I click the lock in the address bar and go to the connection tab.

 

[Jonathan Scott]

The triangle warning sign comes up on the lock in the address bar, and if I click on it to see what the problem is, I see that message.

 

[Jonathan Scott]

I'm using the dev level of Chrome, which seems to have recently updated itself: 40.0.2188.2 dev-m

 

[Greg Bernhardt]

The triangle warning sign comes up on the lock in the address bar, and if I click on it to see what the problem is, I see that message.

Interesting. I'm using 38 at the moment. Do you see such an error using any other browser?

 

[Doug Huffman]

No warning here, with FF 32.0.2 Read the certificate file, all looks good.

 

[Greg Bernhardt]

Thanks Doug. It could be a bug in the Chrome dev release. When 40 goes to release then we can try to diagnose if the warning appears.

 

[Jonathan Scott]

I don't see any problem in Firefox, Opera or Safari. I think I saw some recent news item that said someone had recently demonstrated that it was possible to fake a certificate chain and that something was being tightened up in Chrome to prevent that, so it might be something to do with that. Apart from that, it could of course be a Chrome bug. I use the dev version on my personal laptop to try to get some advance warning of what they will break next in the stable version!

 

[Jonathan Scott]

I've found the description of the change in the Chrome issues: https://code.google.com/p/chromium/issues/detail?id=401365

The title is "Deprecate SHA-1 for certificates".

I haven't fully understood it, but I think they are trying to move people off SHA-1 signing of certificates because it has been demonstrated that it can be faked, and that matches the recent news item.

 

[TumblingDice]

Thanks Doug. It could be a bug in the Chrome dev release. When 40 goes to release then we can try to diagnose if the warning appears.

It's definitely a move by Google with Chrome. I received notices from Symantec for my sites at the beginning of September:

"We would like to inform you of Google's intent to phase out support for certificates using a SHA-1 hashing algorithm via degraded visual indicators and warnings in the Chrome™ browser. These changes are expected to take effect in the production version of Chrome version 39 in November 2014."

Acquiring the SSH-2 update certificates from Symantec was easy. Plan to install at Hostgator next week.

(Last month I had to diagnose a PDF issue with Chrome and found that Google had replaced Adobe PDF support with their own. Had to contact almost a dozen reps in the field because Chrome couldn't accept a date with a year earlier than 1969!)

 

[Greg Bernhardt]

Thanks TD, looks like I need to get a new certificate already. What a PITA.

 

[TumblingDice]

FWIW, Symantec provided the SHA-2 update certs for free and provided an easy website process to acquire. Hope you're experience goes as well or better.

 

[Greg Bernhardt]

I'm updating to SHA-2. There may be some certificate warnings while I'm doing this.

 

[Greg Bernhardt]

@Jonathan Scott do you still get the warning? The connection should be SHA-2 now.

 

[TumblingDice]

Lookin' good, Greg!

 

[Jonathan Scott]

@Jonathan Scott do you still get the warning? The connection should be SHA-2 now.

Warning triangle has gone, thanks.