4 ms·

Something is wrong with your cert

by williamscales 11y ago

eridius 11y ago
Looks valid to me.
deleted 11y ago
[deleted]
deleted 11y ago
[deleted]
idlewords 11y ago
Some other people are saying they've seen Chrome complain, but I can't reproduce it. Please send email (support@pinboard.in) if you can figure out what's up.
- yuhong 11y ago
  Incorrect certificate chain. When you moved to SHA2 certs, you failed to change the intermediates to the "Gandi Standard SSL CA 2" ones.
  - pbarnes_1 11y ago
    1 s:/C=FR/ST=Paris/L=Paris/O=Gandi/CN=Gandi Standard SSL CA 2 i:/C=US/ST=New Jersey/L=Jersey City/O=The USERTRUST Network/CN=USERTrust RSA Certification Authority Nope...?
    - yuhong 11y ago
      Yes, this is the correct intermediate.
      - pbarnes_1 11y ago
        Ah, his blog.pinboard.in and pinboard.in configs are different. @idlewords: http://charlieharvey.org.uk/page/gandi_sha2_intermediate_cert_ssl_tls http://charlieharvey.org.uk/page/gandi_sha2_intermediate_cer... Are you putting the chain certs in the SSLCertificateChainFile file, and not concating them to the SSLCertificateFile?
- darkhorn 11y ago
  https://www.ssllabs.com/ssltest/analyze.html?d=blog.pinboard.in https://www.ssllabs.com/ssltest/analyze.html?d=blog.pinboard... Google Chrome on Android ERR_CERT_AUTHORITY_INVALID You are using obsolute chiper.
  - riking 11y ago
    The actual problem resulting in untrusted cert is the "extra download" certificates.
- deleted 11y ago
  [deleted]
- skuhn 11y ago
  Cert chain is incorrect basically and the browser is fetching intermediate certs to try to make it work. Most of the issues Qualys points out on blog.pinboard.in are not present on pinboard.in itself, so I presume there's a difference in config there that would be a good place to start. They're also running on different versions of Debian (squeeze v. wheezy, which ship different OpenSSLs) which accounts for some of the variance. Also, as Qualys notes, disable RC4 ciphers on pinboard.in and you're in pretty good shape.
- thedufer 11y ago
  It only happens on Android Chrome. SSLLabs reports a bunch of stuff, but it seems like the issue matches http://stackoverflow.com/questions/27892873/ssl-cert-err-cert-authority-invalid-on-mobile-chrome-only http://stackoverflow.com/questions/27892873/ssl-cert-err-cer.... Hopefully a quick fix.

Something is wrong with your cert

eridius 11y ago

Looks valid to me.

deleted 11y ago

[deleted]

deleted 11y ago

[deleted]

idlewords 11y ago

Some other people are saying they've seen Chrome complain, but I can't reproduce it. Please send email (support@pinboard.in) if you can figure out what's up.

yuhong 11y ago
Incorrect certificate chain. When you moved to SHA2 certs, you failed to change the intermediates to the "Gandi Standard SSL CA 2" ones.
- pbarnes_1 11y ago
  1 s:/C=FR/ST=Paris/L=Paris/O=Gandi/CN=Gandi Standard SSL CA 2 i:/C=US/ST=New Jersey/L=Jersey City/O=The USERTRUST Network/CN=USERTrust RSA Certification Authority Nope...?
  - yuhong 11y ago
    Yes, this is the correct intermediate.
    - pbarnes_1 11y ago
      Ah, his blog.pinboard.in and pinboard.in configs are different. @idlewords: http://charlieharvey.org.uk/page/gandi_sha2_intermediate_cert_ssl_tls http://charlieharvey.org.uk/page/gandi_sha2_intermediate_cer... Are you putting the chain certs in the SSLCertificateChainFile file, and not concating them to the SSLCertificateFile?
darkhorn 11y ago
https://www.ssllabs.com/ssltest/analyze.html?d=blog.pinboard.in https://www.ssllabs.com/ssltest/analyze.html?d=blog.pinboard... Google Chrome on Android ERR_CERT_AUTHORITY_INVALID You are using obsolute chiper.
- riking 11y ago
  The actual problem resulting in untrusted cert is the "extra download" certificates.
deleted 11y ago
[deleted]
skuhn 11y ago
Cert chain is incorrect basically and the browser is fetching intermediate certs to try to make it work. Most of the issues Qualys points out on blog.pinboard.in are not present on pinboard.in itself, so I presume there's a difference in config there that would be a good place to start. They're also running on different versions of Debian (squeeze v. wheezy, which ship different OpenSSLs) which accounts for some of the variance. Also, as Qualys notes, disable RC4 ciphers on pinboard.in and you're in pretty good shape.
thedufer 11y ago
It only happens on Android Chrome. SSLLabs reports a bunch of stuff, but it seems like the issue matches http://stackoverflow.com/questions/27892873/ssl-cert-err-cert-authority-invalid-on-mobile-chrome-only http://stackoverflow.com/questions/27892873/ssl-cert-err-cer.... Hopefully a quick fix.