4 ms·

Is HN having SSL problems? Firefox is complaining that HN's SSL cert has not been verified. A screenshot can be seen here: [1] It used to be fine up to today.[

• NathanKP 14y ago
  I had this problem the other day with a site I administrate, in Firefox only. It turns out that Chrome and other browsers have robust and complete certificate chains built in which allow them to trust certificates that Firefox over zealously assumes are not verified if you don't explicitly define a certificate chain file to link your certificate issuer to a root certificate that Firefox does trust. So long story short: Firefox demands a chain file for some certificate issues while other browsers just trust the certificate.
  • schrodinger 14y ago
    I bet what actually happened was that your chain was set up incorrectly, but was cached in Chrome so it appeared ok. If you've already hit another site that uses the same root certificate as your chain, then your site would appear fine. If you haven't (i.e. testing your site in a browser you don't use much), than you'd see an SSL warning. So it might not have been anything different about Firefox, just that Chrome trusted the chain because it had already verified the root for another site with the same chained SSL certificate issuer.
    • NathanKP 14y ago
      That actually could be. I use Chrome primarily and rarely use Firefox so Chrome probably trusted my Network Solutions SSL certificate because it had already encountered and cached a chain file linking Network Solutions back to a trusted root certificate, but Firefox had not cached that chain file yet.
      • schrodinger 14y ago
        Had that same thing happen to me. There are a bunch of free SSL verifiers you can use to debug this in the future, http://www.digicert.com/help/ http://www.digicert.com/help/ being the one I used (some of the other ones required Java, I liked that this one didn't).
      • rwg 14y ago
        At ${PREVIOUS_JOB}, I despised that certificate caching behavior. It did nothing but wallpaper over configuration errors that shouldn't be wallpapered over... Me: "Your site at https://blah.otherdept.myemployer.edu/ https://blah.otherdept.myemployer.edu/ is causing visitors to see SSL errors because your web server isn't sending the certificate chain. It probably got messed up when an updated certificate was installed the other day." Other sysadmin: "It works fine for me. Try clearing your browser's cache." Me: "No, really, it's not that. Here's the openssl s_client output showing that your server is only sending its own certificate and not any intermediate certificates." Other sysadmin: "I just tried from another computer in the office, and the site's working fine. You should call the university's helpdesk since the problem is obviously on your end." Me: profanity
        • nwh 14y ago
          Funnily enough, I had the same conversation just last week.
        • dEnigma 14y ago
          >Me: profanity Thanks, now my screen is full of coffee^^
• gnosis 14y ago
  Looks like it's fixed now.