4 ms·

Problems with my SSL certificate (Let's Encrypt)

4 points by estebanpm 4y ago

Hi! I recently launched the mvp of my startup (planodi.com), I thought that my ssl certificate (I'm using let's encrypt) was working fine, even several users have already registered without any problem. If I visit my page I see the lock in the navigation bar of the browser. My surprise was when yesterday a customer sent me a picture of the browser with the text "https" crossed out and in red with a warning "not secure". Has anyone had a similar problem? any recommendations on how to solve it?

phillipseamore 4y ago
Did you reply to HTTPS requests before with no or an invalid certificate that the customer might have approved to use anyways? Then the domain will be marked unsecure until he restarts his browser. You current HTTPS setup seems to be valid (https://www.ssllabs.com/ssltest/analyze.html?d=planodi.com&hideResults=on&latest https://www.ssllabs.com/ssltest/analyze.html?d=planodi.com&h...).
- estebanpm 4y ago
  Thanks for your answer. I was using a couple of images stored in cloudinary in my site, but I was using them with the insecure url ("http" instead of "https"). I changed it, hopefully that solves the problem.
outsomnia 4y ago
LE's original CA root cert expired a few months ago https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/ https://letsencrypt.org/docs/dst-root-ca-x3-expiration-septe... under some conditions older devices that have not been updated neither accept the expired root CA, nor have a copy of the replacement cert. You should ask the user about his system, when he last updated it etc.
- estebanpm 4y ago
  Thanks for the insight!
saluki 4y ago
Run the url in their screenshot through https://www.whynopadlock.com/ https://www.whynopadlock.com/ I would expect it is: Insecure calls to images, css, and javascript, including 3rd party calls. But that should be a good first step to tracking down the issue.
- estebanpm 4y ago
  Thanks for the insight. I think the problem was indeed an insecure image call, I will wait for the user's feedback.
creeble 4y ago
I'm having a similar problem, with (I think, can't tell yet) Android clients. My cert was updated by certbot a couple of days ago, and suddenly certain (old, presumably) Android clients are failing to connect. I had to fix the problem that happened in Sept 2021 (with the "X3" cert expiring), but now, two or three certbot runs since, it's a problem again. Not clear what the problem is, also looking for insights.

4 points by estebanpm 4y ago

phillipseamore 4y ago

Did you reply to HTTPS requests before with no or an invalid certificate that the customer might have approved to use anyways? Then the domain will be marked unsecure until he restarts his browser. You current HTTPS setup seems to be valid (https://www.ssllabs.com/ssltest/analyze.html?d=planodi.com&hideResults=on&latest https://www.ssllabs.com/ssltest/analyze.html?d=planodi.com&h...).

estebanpm 4y ago
Thanks for your answer. I was using a couple of images stored in cloudinary in my site, but I was using them with the insecure url ("http" instead of "https"). I changed it, hopefully that solves the problem.

outsomnia 4y ago

LE's original CA root cert expired a few months ago https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/ https://letsencrypt.org/docs/dst-root-ca-x3-expiration-septe... under some conditions older devices that have not been updated neither accept the expired root CA, nor have a copy of the replacement cert. You should ask the user about his system, when he last updated it etc.

estebanpm 4y ago
Thanks for the insight!

saluki 4y ago

Run the url in their screenshot through https://www.whynopadlock.com/ https://www.whynopadlock.com/ I would expect it is: Insecure calls to images, css, and javascript, including 3rd party calls. But that should be a good first step to tracking down the issue.

estebanpm 4y ago
Thanks for the insight. I think the problem was indeed an insecure image call, I will wait for the user's feedback.

creeble 4y ago

I'm having a similar problem, with (I think, can't tell yet) Android clients. My cert was updated by certbot a couple of days ago, and suddenly certain (old, presumably) Android clients are failing to connect. I had to fix the problem that happened in Sept 2021 (with the "X3" cert expiring), but now, two or three certbot runs since, it's a problem again. Not clear what the problem is, also looking for insights.