4 ms·

You have a serious problem. The valid site is signed with a valid Entrust certificate. https://www.ssllabs.com/ssltest/analyze.html?d=isapps.acxiom.com https://

by dsl 12y ago

You have a serious problem. The valid site is signed with a valid Entrust certificate. https://www.ssllabs.com/ssltest/analyze.html?d=isapps.acxiom.com https://www.ssllabs.com/ssltest/analyze.html?d=isapps.acxiom... Are you at work or on a coffee shop network where SSL traffic might be intercepted?

TheCraiggers 12y ago
I actually get the exact same response. I presume that youngtaff is probably behind a corporate firewall like I am which has the ability to be a man in the middle for SSL sessions. Zero expectation of privacy at my workplace.
- BuildTheRobots 12y ago
  I seemed to get the same error using 3G-data on my android phone.... I don't think EE(uk) tries MITMing web browsing, but I wouldn't put it past them...
chigley 12y ago
I ran the Qualsys SSL Labs test on the site[0]. It reports an incomplete chain; that is, the server doesn't supply the intermediate certificate required (Entrust Certification Authority - L1C) to bridge the gap between the site's certificate and the Entrust certificate in most browser/OS stores. This intermediate certificate must instead be downloaded by the browser. I suspect, therefore, that some browsers do not have the intermediate certificate and so the certificate cannot be validated. [0] https://www.ssllabs.com/ssltest/analyze.html?d=isapps.acxiom.com https://www.ssllabs.com/ssltest/analyze.html?d=isapps.acxiom...
- youngtaff 12y ago
  The intermediate cert should be requested from the server - might take a peak with wireshark if I've got time later. I work for a security company so have zero expectations of privacy when I'm on the corporate network (which I was here) but I also see the same issue on both 3 and EE in the UK. I don't generally see issues like this on the corporate network so there's something different about this case. Of course Acxiom really should serve the site and intermediate certificates together to reduce round-trips and speed up the handshake.

by dsl 12y ago

TheCraiggers 12y ago

I actually get the exact same response. I presume that youngtaff is probably behind a corporate firewall like I am which has the ability to be a man in the middle for SSL sessions. Zero expectation of privacy at my workplace.

BuildTheRobots 12y ago
I seemed to get the same error using 3G-data on my android phone.... I don't think EE(uk) tries MITMing web browsing, but I wouldn't put it past them...

chigley 12y ago

I ran the Qualsys SSL Labs test on the site[0]. It reports an incomplete chain; that is, the server doesn't supply the intermediate certificate required (Entrust Certification Authority - L1C) to bridge the gap between the site's certificate and the Entrust certificate in most browser/OS stores. This intermediate certificate must instead be downloaded by the browser. I suspect, therefore, that some browsers do not have the intermediate certificate and so the certificate cannot be validated. [0] https://www.ssllabs.com/ssltest/analyze.html?d=isapps.acxiom.com https://www.ssllabs.com/ssltest/analyze.html?d=isapps.acxiom...

youngtaff 12y ago
The intermediate cert should be requested from the server - might take a peak with wireshark if I've got time later. I work for a security company so have zero expectations of privacy when I'm on the corporate network (which I was here) but I also see the same issue on both 3 and EE in the UK. I don't generally see issues like this on the corporate network so there's something different about this case. Of course Acxiom really should serve the site and intermediate certificates together to reduce round-trips and speed up the handshake.