3 ms·
Even Facebook can't get their SSL setup right
- Jules8850 15y agoSpecifically on the edge server we hit in that particular test (69.171.228.13), they haven't installed their intermediate certificate chain. Allowing insecure re-negotiation isn't too crash hot, either.
- tlrobinson 15y agoCurrently Chrome is showing me a green lock icon for https://facebook.com/ https://facebook.com/ but if I hit that particularly edge server (or another misconfigured one) would it warn me first? Or at least show the red lock?
- Jules8850 15y agoMost likely the browser would not complain; it will block, fetch the intermediate certificates (if possible), verify the signatures, then proceed. So probably just a performance hit in most cases. Full explanation here: https://www.wormly.com/help/ssl-tests/intermediate-cert-chain https://www.wormly.com/help/ssl-tests/intermediate-cert-chai...
- laz 15y agoAFAICT, the tool is broken WRT renegotiation detection. ~% openssl s_client -connect 69.171.228.13:443 2>/dev/null < /dev/null | grep Reneg Secure Renegotiation IS NOT supported
- laz 15y agoMissing certs in the chain are fixed, BTW. Thanks for pointing it out. We tracked down a bug in config autogeneration, and are going to add paranoia to monitor for it in the future.
- lox 15y agoGreat tool, been looking for one of these since tlsreports stopped working.
- extension 15y agoIs this why I always get SSL warnings from embedded FB widgets on my iPad? Also, FB is not exactly the gold standard for.. um.. things working.
- foobarbazetc 15y agoThere's nothing wrong with that. Your testing tool just doesn't have DigiCert installed as a trusted cert. Use this instead: http://www.ssllabs.com/ http://www.ssllabs.com/