4 ms·
Specifically on the edge server we hit in that particular test (69.171.228.13), they haven't installed their intermediate certificate chain. Allowing insecure
by Jules8850 15y ago
Specifically on the edge server we hit in that particular test (69.171.228.13), they haven't installed their intermediate certificate chain.
Allowing insecure re-negotiation isn't too crash hot, either.
- tlrobinson 15y agoCurrently Chrome is showing me a green lock icon for https://facebook.com/ https://facebook.com/ but if I hit that particularly edge server (or another misconfigured one) would it warn me first? Or at least show the red lock?
- Jules8850 15y agoMost likely the browser would not complain; it will block, fetch the intermediate certificates (if possible), verify the signatures, then proceed. So probably just a performance hit in most cases. Full explanation here: https://www.wormly.com/help/ssl-tests/intermediate-cert-chain https://www.wormly.com/help/ssl-tests/intermediate-cert-chai...
- laz 15y agoAFAICT, the tool is broken WRT renegotiation detection. ~% openssl s_client -connect 69.171.228.13:443 2>/dev/null < /dev/null | grep Reneg Secure Renegotiation IS NOT supported
- laz 15y agoMissing certs in the chain are fixed, BTW. Thanks for pointing it out. We tracked down a bug in config autogeneration, and are going to add paranoia to monitor for it in the future.