17 ms·

Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate

213 points by doughj3 10y ago

mstefff 10y ago
Happening with BofA too.
dantillberg 10y ago
This bit me on both the NYT and WSJ websites this past week using Chrome 53; CDNs they were using both broke with this error. Upgrading to Chrome 54 seemed to solved the problem for me (I'm using arch linux, fwiw).
- dfeart3453465uf 10y ago
  me too, i saw it on amazon broken. i updated my chromium and all good.
robertelder 10y ago
I'm using Chromium on Ubuntu 16, and I've been trying to visit https://www.nist.gov/ https://www.nist.gov/ but I don't even get an option to 'browse insecurely' under the 'Advanced' link. In my experience that past couple days, I get the warning on about 10-25% of major web sites.
- dijit 10y ago
  try typing 'badidea' on that page and report back if it works. :)
  - wereHamster 10y ago
    Can you explain that trick?
    - robertelder 10y ago
      I Googled it and found this: https://www.reddit.com/r/sysadmin/comments/42xd4i/chrome_danger_shortcut_changed_to_badidea/ https://www.reddit.com/r/sysadmin/comments/42xd4i/chrome_dan...
  - deleted 10y ago
    [deleted]
  - rgbrenner 10y ago
    actually works
  - aidos 10y ago
    Well there's a nice little easter egg, I could have really done with that a week ago while doing a load of provision testing with LE staging certs!
  - swiley 10y ago
    I love how discoverable GUIs are.
  - pilooch 10y ago
    Very nice :) Thanks.
- doughj3 10y ago
  > In my experience that past couple days, I get the warning on about 10-25% of major web sites. I'm finding about the same, including major sites like Mint.com and Amazon (or part of Amazon's CDN for images, anyway). I'm running a slightly older Ubuntu and as of now, Chromium 53 is the latest in the repos...
- freehunter 10y ago
  Ugh that's the worst. I work on servers where the GUI can only be accessed using HTTPS, but its all internal so many clients don't bother. And I don't know why browsers sometimes don't let me say "continue anyway" but it's super frustrating.
  - jakobbuis 10y ago
    Using HSTS on a website will generally prevent your browser from allowing you to continue, which is fair: the website owner has explicitly indicated the website should only ever be used over a encrypted connection, and that is not the case..
    - paulddraper 10y ago
      I understand who owns the website. Who owns my browser?
      - AtheistOfFail 10y ago
        The manufacturer.
      - snug 10y ago
        To be RFC compliant, it MUST NOT allow the user to ignore the errors. 12.1. No User Recourse Failing secure connection establishment on any warnings or errors (per Section 8.4 ("Errors in Secure Transport Establishment")) should be done with "no user recourse". This means that the user should not be presented with a dialog giving her the option to proceed. Rather, it should be treated similarly to a server error where there is nothing further the user can do with respect to interacting with the target web application, other than wait and retry. Essentially, "any warnings or errors" means anything that would cause the UA implementation to announce to the user that something is not entirely correct with the connection establishment. Not doing this, i.e., allowing user recourse such as "clicking through warning/error dialogs", is a recipe for a man-in-the-middle attack. If a web application issues an HSTS Policy, then it is implicitly opting into the "no user recourse" approach, whereby all certificate errors or warnings cause a connection termination, with no chance to "fool" users into making the wrong decision and compromising themselves. https://tools.ietf.org/html/rfc6797#section-12.1 https://tools.ietf.org/html/rfc6797#section-12.1
- tremendo 10y ago
  I do get the "proceed to www.xxx (unsafe)" under Advanced. Version 53.0.2785.143 Built on Ubuntu , running on Ubuntu 16.04 (64-bit)
- jlgaddis 10y ago
  I get the error on the NIST web site [0] as well. I do have the "Proceed to ..." option, though, as you can see in my screenshot [1]. The same thing happens on the Chase Bank URL [2] mentioned in the article. Clicking "Proceed to ..." then redirects me to another URL [3] which throws up the same error. If I click "Proceed to ..." on that URL, I then get an ironic login page [4]. $ lsb_release -d Description: Ubuntu 16.04.1 LTS $ apt show chromium-browser | grep ^Version Version: 53.0.2785.143-0ubuntu0.16.04.1.1254 $ chromium-browser --version Chromium 53.0.2785.143 Built on Ubuntu , running on Ubuntu 16.04 Perhaps there's a setting somewhere that you've toggled? Maybe it's HSTS or something similar? [0]: https://www.nist.gov/ https://www.nist.gov/ [1]: http://i.imgur.com/QbgBxyB.png http://i.imgur.com/QbgBxyB.png [2]: https://choosemyreward.chase.com/ https://choosemyreward.chase.com/ [3]: https://chaseonline.chase.com/Logon.aspx https://chaseonline.chase.com/Logon.aspx [4]: http://i.imgur.com/KFqiwNG.png http://i.imgur.com/KFqiwNG.png
rgbrenner 10y ago
"Too many websites have chosen redaction incorrectly" I purchased a Symantec cert from ssls.com for one of my sites. I wasn't given the option of redacting anything.. yet I'm seeing this error with Chrome 53 in Linux. (I also have Chrome 54 on another computer, and it's working fine). There are clearly other ways of ending up with a certificate that triggers this.
- nothrabannosir 10y ago
  Did you find your cert in the public log? What does the host name look like? Is it redacted? Maybe they did it without confirming with you, first :/
  - rgbrenner 10y ago
    Checked, and it's not redacted.
- agwa 10y ago
  > There are clearly other ways of ending up with a certificate that triggers this. The update at the top of the blog post should explain why this error message is triggered even with an unredacted certificate.
  - rgbrenner 10y ago
    Yes, thanks. The cert isn't redacted. I read the update, then read the article, and forgot all about it. That probably explains it.
- vtlynch 10y ago
  Would you mind sharing the domain?
longwave 10y ago
The wider bug affects all versions of Ubuntu using Chromium from the universe repo, which is a 10 week old build of Chrome 53. Launchpad bug: https://bugs.launchpad.net/ubuntu/+source/chromium-browser/+bug/1641380 https://bugs.launchpad.net/ubuntu/+source/chromium-browser/+...
lifeisstillgood 10y ago
tl;dr: Symantec have tried to implement a broken version of Certificate Transparency on their Certs when IETF have not finished the spec. As such new Symantec certificates don't work in newer versions of Chrome. Crazy but true. Kudos to the site owner - clear and simple and authoritative explanation (Although I see the hand of politics behind this. "Hey we really fucked up the Google.com certificates. The board insists we do what Google wants and implement full certificate transparency by June 30. And it took two hours to explain it to the board so I am not going back to explain that it's all changed - Just implement the most recent IETF draft. Then I can tell the board it's done. What's the worst that can happen!" Oh ....)
hxegon 10y ago
Was wondering why a bunch of websites were giving me ssl errors, but working in firefox.
agwa 10y ago
Author here. It has gotten kind of hard to follow what has happened, so here's a chronology: 1. In September, Chrome 53 was released, which enabled mandatory Certificate Transparency for Symantec certificates due to Symantec's history of incompetence. Some website operators, such as Chase, asked Symantec to submit their certificates to Certificate Transparency logs in such a way that the certificate wouldn't be trusted by Chrome, triggering the ERR_CERTIFICATE_TRANSPARENCY_REQUIRED error. This is when I wrote this blog post. 2. Last week, an internal timebomb expired in older versions of Chrome causing this error message for any website using a Symantec certificate issued since June. Basically, Chrome contains a list of Certificate Transparency logs that it trusts, and this list has a 10 week expiration date. So if Chrome was built more than 10 weeks ago, there would be no trusted Certificate Transparency logs, and therefore any certificate that was supposed to be logged (such as new Symantec certs) would be untrusted and display this error message. The Chrome team was able to fix this within 24 hours by remotely disabling CT enforcement in Chrome. (When Chrome starts up, it fetches a list of feature flags from a Chrome server using a system called Finch which is independent of the normal upgrade system.) 3. Today, the Chromium packages in several Linux distros, including Ubuntu, became 10 weeks old. For some reason, they have not picked up the Finch update, and so they are displaying this error message for all Symantec certificates issued since June. This is not confirmed yet, but the current hypothesis is that the distros have disabled Finch for privacy reasons. It will probably require a distro package upgrade to fix.
- swalsh 10y ago
  Is there any reason, in 2016, to use Symantec over LetsEncrypt?
  - xyzzy123 10y ago
    extended validation (mandatory for bigcos) and support contracts (important for corporates, not sure how useful "in real life"). Also, inventory management, which is helpful when you have hundreds or thousands of certs.
    - walrus01 10y ago
classycoder 10y ago
listen , fuck Certificates and who ever uses them. Certificates are for homosexuals
joering2 10y ago
Somewhat off-topic but what a horrible bank they are. A friend of mine's father almost got a heart attack by trying to refinance their underwater house. Despite of being a US veteran and government willing to sponsor their whole mortage through some special aid program, Chase chosen not to accept check from said agency. If that would be check from him they would gladly take it.. but not from gov. Government, of course will not want to write a check for him, so its a catch 22. They currently file a lawsuit that Chase gladly accepted (thank God my friend has a good lawyer who took it pro-bono), but it just shows you to what extent they will go just to make an extra buck.
Arathorn 10y ago
This has been wreaking havoc for matrix.org and riot.im all day - we blogged about it earlier: https://matrix.org/blog/2016/11/14/ssl-issues-with-chromium https://matrix.org/blog/2016/11/14/ssl-issues-with-chromium. Tempted to move off RapidSSL wildcard certs to a bajillion LetsEncrypts...
- discreditable 10y ago
  Watch out for the rate limits: https://letsencrypt.org/docs/rate-limits/ https://letsencrypt.org/docs/rate-limits/
du_bing 10y ago
I am in China, when I open baidu.com, zhihu.com, Chromium will throw the private error. There is an interesting solution, on the page of private error, input "badidea", the browser will automaticly redirect to the targeted website. But it may be a "bad idea". Now I use Firefox to open these sites.
- discreditable 10y ago
  Chrome had a different bypass password until recently. They've shown that when a password catches on among the wrong folks they will change it.
foxylad 10y ago
This is affecting Australia's Suncorp internet banking too. We reported the certificate error to them yesterday, and I've just updated that with a link to this article.
deleted 10y ago
[deleted]
bastard_op 10y ago
Interesting enough, just got this error trying to buy something on ebay for pay.ebay.com requiring transparency now.
known 10y ago
No problem in Version 54.0.2840.100 (64-bit)
porges 10y ago
Forgive my ignorance, but if you're issuing certificates for internal hostnames that you want to keep private, why would you need a public cert? Wouldn't an internal CA be better?
discordianfish 10y ago
Upgrade to fixed chromium from staging ppa on Ubuntu: sudo add-apt-repository ppa:canonical-chromium-builds/stage sudo apt-get update sudo apt-get install chromium-browser

213 points by doughj3 10y ago

Happening with BofA too.

This bit me on both the NYT and WSJ websites this past week using Chrome 53; CDNs they were using both broke with this error. Upgrading to Chrome 54 seemed to solved the problem for me (I'm using arch linux, fwiw).

dfeart3453465uf 10y ago
me too, i saw it on amazon broken. i updated my chromium and all good.

robertelder 10y ago

I'm using Chromium on Ubuntu 16, and I've been trying to visit https://www.nist.gov/ https://www.nist.gov/ but I don't even get an option to 'browse insecurely' under the 'Advanced' link. In my experience that past couple days, I get the warning on about 10-25% of major web sites.

dijit 10y ago
try typing 'badidea' on that page and report back if it works. :)
- wereHamster 10y ago
  Can you explain that trick?
  - robertelder 10y ago
    I Googled it and found this: https://www.reddit.com/r/sysadmin/comments/42xd4i/chrome_danger_shortcut_changed_to_badidea/ https://www.reddit.com/r/sysadmin/comments/42xd4i/chrome_dan...
- deleted 10y ago
  [deleted]
- rgbrenner 10y ago
  actually works
- aidos 10y ago
  Well there's a nice little easter egg, I could have really done with that a week ago while doing a load of provision testing with LE staging certs!
- swiley 10y ago
  I love how discoverable GUIs are.
- pilooch 10y ago
  Very nice :) Thanks.
doughj3 10y ago
> In my experience that past couple days, I get the warning on about 10-25% of major web sites. I'm finding about the same, including major sites like Mint.com and Amazon (or part of Amazon's CDN for images, anyway). I'm running a slightly older Ubuntu and as of now, Chromium 53 is the latest in the repos...
freehunter 10y ago
Ugh that's the worst. I work on servers where the GUI can only be accessed using HTTPS, but its all internal so many clients don't bother. And I don't know why browsers sometimes don't let me say "continue anyway" but it's super frustrating.
- jakobbuis 10y ago
  Using HSTS on a website will generally prevent your browser from allowing you to continue, which is fair: the website owner has explicitly indicated the website should only ever be used over a encrypted connection, and that is not the case..
  - paulddraper 10y ago
    I understand who owns the website. Who owns my browser?
    - AtheistOfFail 10y ago
      The manufacturer.
    - snug 10y ago
      To be RFC compliant, it MUST NOT allow the user to ignore the errors. 12.1. No User Recourse Failing secure connection establishment on any warnings or errors (per Section 8.4 ("Errors in Secure Transport Establishment")) should be done with "no user recourse". This means that the user should not be presented with a dialog giving her the option to proceed. Rather, it should be treated similarly to a server error where there is nothing further the user can do with respect to interacting with the target web application, other than wait and retry. Essentially, "any warnings or errors" means anything that would cause the UA implementation to announce to the user that something is not entirely correct with the connection establishment. Not doing this, i.e., allowing user recourse such as "clicking through warning/error dialogs", is a recipe for a man-in-the-middle attack. If a web application issues an HSTS Policy, then it is implicitly opting into the "no user recourse" approach, whereby all certificate errors or warnings cause a connection termination, with no chance to "fool" users into making the wrong decision and compromising themselves. https://tools.ietf.org/html/rfc6797#section-12.1 https://tools.ietf.org/html/rfc6797#section-12.1
tremendo 10y ago
I do get the "proceed to www.xxx (unsafe)" under Advanced. Version 53.0.2785.143 Built on Ubuntu , running on Ubuntu 16.04 (64-bit)
jlgaddis 10y ago
I get the error on the NIST web site [0] as well. I do have the "Proceed to ..." option, though, as you can see in my screenshot [1]. The same thing happens on the Chase Bank URL [2] mentioned in the article. Clicking "Proceed to ..." then redirects me to another URL [3] which throws up the same error. If I click "Proceed to ..." on that URL, I then get an ironic login page [4]. $ lsb_release -d Description: Ubuntu 16.04.1 LTS $ apt show chromium-browser | grep ^Version Version: 53.0.2785.143-0ubuntu0.16.04.1.1254 $ chromium-browser --version Chromium 53.0.2785.143 Built on Ubuntu , running on Ubuntu 16.04 Perhaps there's a setting somewhere that you've toggled? Maybe it's HSTS or something similar? [0]: https://www.nist.gov/ https://www.nist.gov/ [1]: http://i.imgur.com/QbgBxyB.png http://i.imgur.com/QbgBxyB.png [2]: https://choosemyreward.chase.com/ https://choosemyreward.chase.com/ [3]: https://chaseonline.chase.com/Logon.aspx https://chaseonline.chase.com/Logon.aspx [4]: http://i.imgur.com/KFqiwNG.png http://i.imgur.com/KFqiwNG.png

rgbrenner 10y ago

"Too many websites have chosen redaction incorrectly" I purchased a Symantec cert from ssls.com for one of my sites. I wasn't given the option of redacting anything.. yet I'm seeing this error with Chrome 53 in Linux. (I also have Chrome 54 on another computer, and it's working fine). There are clearly other ways of ending up with a certificate that triggers this.

nothrabannosir 10y ago
Did you find your cert in the public log? What does the host name look like? Is it redacted? Maybe they did it without confirming with you, first :/
- rgbrenner 10y ago
  Checked, and it's not redacted.
agwa 10y ago
> There are clearly other ways of ending up with a certificate that triggers this. The update at the top of the blog post should explain why this error message is triggered even with an unredacted certificate.
- rgbrenner 10y ago
  Yes, thanks. The cert isn't redacted. I read the update, then read the article, and forgot all about it. That probably explains it.
vtlynch 10y ago
Would you mind sharing the domain?

longwave 10y ago

The wider bug affects all versions of Ubuntu using Chromium from the universe repo, which is a 10 week old build of Chrome 53. Launchpad bug: https://bugs.launchpad.net/ubuntu/+source/chromium-browser/+bug/1641380 https://bugs.launchpad.net/ubuntu/+source/chromium-browser/+...

lifeisstillgood 10y ago

tl;dr: Symantec have tried to implement a broken version of Certificate Transparency on their Certs when IETF have not finished the spec. As such new Symantec certificates don't work in newer versions of Chrome. Crazy but true. Kudos to the site owner - clear and simple and authoritative explanation (Although I see the hand of politics behind this. "Hey we really fucked up the Google.com certificates. The board insists we do what Google wants and implement full certificate transparency by June 30. And it took two hours to explain it to the board so I am not going back to explain that it's all changed - Just implement the most recent IETF draft. Then I can tell the board it's done. What's the worst that can happen!" Oh ....)

hxegon 10y ago

Was wondering why a bunch of websites were giving me ssl errors, but working in firefox.

agwa 10y ago

Author here. It has gotten kind of hard to follow what has happened, so here's a chronology: 1. In September, Chrome 53 was released, which enabled mandatory Certificate Transparency for Symantec certificates due to Symantec's history of incompetence. Some website operators, such as Chase, asked Symantec to submit their certificates to Certificate Transparency logs in such a way that the certificate wouldn't be trusted by Chrome, triggering the ERR_CERTIFICATE_TRANSPARENCY_REQUIRED error. This is when I wrote this blog post. 2. Last week, an internal timebomb expired in older versions of Chrome causing this error message for any website using a Symantec certificate issued since June. Basically, Chrome contains a list of Certificate Transparency logs that it trusts, and this list has a 10 week expiration date. So if Chrome was built more than 10 weeks ago, there would be no trusted Certificate Transparency logs, and therefore any certificate that was supposed to be logged (such as new Symantec certs) would be untrusted and display this error message. The Chrome team was able to fix this within 24 hours by remotely disabling CT enforcement in Chrome. (When Chrome starts up, it fetches a list of feature flags from a Chrome server using a system called Finch which is independent of the normal upgrade system.) 3. Today, the Chromium packages in several Linux distros, including Ubuntu, became 10 weeks old. For some reason, they have not picked up the Finch update, and so they are displaying this error message for all Symantec certificates issued since June. This is not confirmed yet, but the current hypothesis is that the distros have disabled Finch for privacy reasons. It will probably require a distro package upgrade to fix.

swalsh 10y ago
Is there any reason, in 2016, to use Symantec over LetsEncrypt?
- xyzzy123 10y ago
  extended validation (mandatory for bigcos) and support contracts (important for corporates, not sure how useful "in real life"). Also, inventory management, which is helpful when you have hundreds or thousands of certs.
  - walrus01 10y ago

classycoder 10y ago

listen , fuck Certificates and who ever uses them. Certificates are for homosexuals

joering2 10y ago

Somewhat off-topic but what a horrible bank they are. A friend of mine's father almost got a heart attack by trying to refinance their underwater house. Despite of being a US veteran and government willing to sponsor their whole mortage through some special aid program, Chase chosen not to accept check from said agency. If that would be check from him they would gladly take it.. but not from gov. Government, of course will not want to write a check for him, so its a catch 22. They currently file a lawsuit that Chase gladly accepted (thank God my friend has a good lawyer who took it pro-bono), but it just shows you to what extent they will go just to make an extra buck.

Arathorn 10y ago

This has been wreaking havoc for matrix.org and riot.im all day - we blogged about it earlier: https://matrix.org/blog/2016/11/14/ssl-issues-with-chromium https://matrix.org/blog/2016/11/14/ssl-issues-with-chromium. Tempted to move off RapidSSL wildcard certs to a bajillion LetsEncrypts...

discreditable 10y ago
Watch out for the rate limits: https://letsencrypt.org/docs/rate-limits/ https://letsencrypt.org/docs/rate-limits/

du_bing 10y ago

I am in China, when I open baidu.com, zhihu.com, Chromium will throw the private error. There is an interesting solution, on the page of private error, input "badidea", the browser will automaticly redirect to the targeted website. But it may be a "bad idea". Now I use Firefox to open these sites.

discreditable 10y ago
Chrome had a different bypass password until recently. They've shown that when a password catches on among the wrong folks they will change it.

foxylad 10y ago

This is affecting Australia's Suncorp internet banking too. We reported the certificate error to them yesterday, and I've just updated that with a link to this article.

deleted 10y ago

[deleted]

bastard_op 10y ago

Interesting enough, just got this error trying to buy something on ebay for pay.ebay.com requiring transparency now.

known 10y ago

No problem in Version 54.0.2840.100 (64-bit)

porges 10y ago

Forgive my ignorance, but if you're issuing certificates for internal hostnames that you want to keep private, why would you need a public cert? Wouldn't an internal CA be better?

discordianfish 10y ago

Upgrade to fixed chromium from staging ppa on Ubuntu: sudo add-apt-repository ppa:canonical-chromium-builds/stage sudo apt-get update sudo apt-get install chromium-browser