4 ms·
Also not liked by Brave Version 1.1.21 Chromium: 79.0.3945.79 (Official Build) (64-bit)
by bradknowles 7y ago
Also not liked by Brave Version 1.1.21 Chromium: 79.0.3945.79 (Official Build) (64-bit)
- davidlstanton 7y agoHmmm, we're using a Let's Encrypt Cert which is coming up as valid on Chrome, Firefox 71.0 and Safari for us. We have seen problems with OpenDNS - any chance you using that?
- bradknowles 7y agoI'm not using OpenDNS myself, but it does appear that the local nameservers are. Sigh....
- bradknowles 7y agoAt least some of the queries for this domain name are coming back pointed to 35.189.102.199 (199.102.189.35.bc.googleusercontent.com), which seems to be okay on the SSL certificate (see https://www.ssllabs.com/ssltest/analyze.html?d=got-it.com https://www.ssllabs.com/ssltest/analyze.html?d=got-it.com ) even though they offer TLS 1.1 in addition to TLS 1.2. However, other DNS queries get pointed to 146.112.61.106 (hit-adult.opendns.com), and according to testssl.sh offers only TLS 1.2, but doesn't have server cipher order, and has an incomplete chain of trust. The latter IP address also seems to be vulnerable to Secure Client-Initiated Renegotiation, and BEAST (CVE-2011-3389), and maybe LUCKY13 (CVE-2013-0169).
- davidlstanton 7y agoThanks very much for bringing this up and looking into it for us. We're on it now!
- davidlstanton 7y agoI've manually flushed open dns and dig is now only reporting 35.189.102.199 any chance it's now working for you?
- 6wfu5c1ci1lm8 7y agoNope. Still borked on OpenDNS.
- davidlstanton 7y agoCries... I'll dig deeper into this tomorrow. Cheers for sharing.
- davidlstanton 7y agoLooks like it's been content blocked with Open DNS on their family friendly DNS servers. I've submitted a request for it to be categorised. Previous experience is that this takes a few days.