Is Chrome Still Showing Certificate Warning for Outdated Security Settings?

  • Thread starter Thread starter Jonathan Scott
  • Start date Start date
  • Tags Tags
    Chrome
AI Thread Summary
Chrome users are encountering a warning indicating that a website's identity is verified by RapidSSL CA but lacks public audit records, alongside outdated security settings that may hinder future access. This warning appears when clicking the lock icon in the address bar and navigating to the connection tab. Users on different browser versions, such as Firefox and Opera, report no similar warnings, suggesting a potential bug in the Chrome dev release. Discussions highlight a recent shift by Google to phase out SHA-1 certificates due to security vulnerabilities, prompting users to update to SHA-2 certificates. Symantec has been providing these updates for free, and users are successfully resolving the warnings after transitioning to SHA-2. The conversation reflects ongoing adjustments in browser security protocols and the importance of keeping certificates updated to maintain website accessibility.
Jonathan Scott
Gold Member
Messages
2,344
Reaction score
1,184
Chrome is giving the following warning:

The identity of this website has been verified by RapidSSL CA but it does not have public audit records.

The site is using outdated security settings that may prevent future versions of Chrome from being able to safely access it.
 
Computer science news on Phys.org
How is that message being presented? I am using the latest Chrome and only see that text if I click the lock in the address bar and go to the connection tab.
 
The triangle warning sign comes up on the lock in the address bar, and if I click on it to see what the problem is, I see that message.
 
I'm using the dev level of Chrome, which seems to have recently updated itself: 40.0.2188.2 dev-m
 
Jonathan Scott said:
The triangle warning sign comes up on the lock in the address bar, and if I click on it to see what the problem is, I see that message.
Interesting. I'm using 38 at the moment. Do you see such an error using any other browser?
 
No warning here, with FF 32.0.2 Read the certificate file, all looks good.
 
Thanks Doug. It could be a bug in the Chrome dev release. When 40 goes to release then we can try to diagnose if the warning appears.
 
I don't see any problem in Firefox, Opera or Safari. I think I saw some recent news item that said someone had recently demonstrated that it was possible to fake a certificate chain and that something was being tightened up in Chrome to prevent that, so it might be something to do with that. Apart from that, it could of course be a Chrome bug. I use the dev version on my personal laptop to try to get some advance warning of what they will break next in the stable version!
 
  • Like
Likes Greg Bernhardt
I've found the description of the change in the Chrome issues: https://code.google.com/p/chromium/issues/detail?id=401365

The title is "Deprecate SHA-1 for certificates".

I haven't fully understood it, but I think they are trying to move people off SHA-1 signing of certificates because it has been demonstrated that it can be faked, and that matches the recent news item.
 
  • #10
Greg Bernhardt said:
Thanks Doug. It could be a bug in the Chrome dev release. When 40 goes to release then we can try to diagnose if the warning appears.
It's definitely a move by Google with Chrome. I received notices from Symantec for my sites at the beginning of September:

"We would like to inform you of Google's intent to phase out support for certificates using a SHA-1 hashing algorithm via degraded visual indicators and warnings in the Chrome™ browser. These changes are expected to take effect in the production version of Chrome version 39 in November 2014."

Acquiring the SSH-2 update certificates from Symantec was easy. Plan to install at Hostgator next week.

(Last month I had to diagnose a PDF issue with Chrome and found that Google had replaced Adobe PDF support with their own. Had to contact almost a dozen reps in the field because Chrome couldn't accept a date with a year earlier than 1969!)
 
  • Like
Likes Greg Bernhardt
  • #11
Thanks TD, looks like I need to get a new certificate already. What a PITA.
 
  • #12
FWIW, Symantec provided the SHA-2 update certs for free and provided an easy website process to acquire. Hope you're experience goes as well or better.
 
  • #13
I'm updating to SHA-2. There may be some certificate warnings while I'm doing this.
 
  • #15
Lookin' good, Greg!

pf-cert.png
 
  • Like
Likes Greg Bernhardt
  • #16
Greg Bernhardt said:
@Jonathan Scott do you still get the warning? The connection should be SHA-2 now.

Warning triangle has gone, thanks.
 
  • Like
Likes Greg Bernhardt
Back
Top