6 ms·

Apple.com currently has a self-signed certificate (fixed now)

44 points by quonn 12y ago

apple.com currently does not have a valid certificate. Note that I'm accessing the page from Europe, so this is not the issue with China MITM-ing iCloud.

M4v3R 12y ago
Strange. I get that too. Certificate is signed by "Apple IST CA 2 - G1", with 256-bit RSA. Of course accessing their website normally doesn't go through SSL so most people won't see this.
capecodcarl 12y ago
Go to https://www.apple.com https://www.apple.com and not https://apple.com https://apple.com to get the correct site with the proper certificate. apple.com != www.apple.com
- quonn 12y ago
  I know, but I always just type apple.com. It is still a problem.
  - teamhappy 12y ago
    Not anymore. They added a redirect. OS X talks to plenty of apple.com subdomains and there really is no reason not to use self-signed certificates for this kind of thing.
    - alternize 12y ago
      the redirect happens _after_ the certificate warning. to get to the redirect, you have to accept the self signed certificate first. so it might still scare people away, and rightfully so: normal folks cannot distinguish a self signed certificate from a malicious used one f.e. used in phishing attempts.
      - quonn 12y ago
        > normal folks cannot distinguish a self signed certificate from a malicious used one What do you mean with "normal folks"? Nobody can possibly distinguish this, since an attacker would also just use a self-signed certificate.
      - teamhappy 12y ago
        You're right, of course. Did they change the certificate? https://www.sslshopper.com/ssl-checker.html#hostname=apple.com https://www.sslshopper.com/ssl-checker.html#hostname=apple.c... https://www.sslshopper.com/ssl-checker.html#hostname=www.apple.com https://www.sslshopper.com/ssl-checker.html#hostname=www.app...
- lstamour 12y ago
  Indeed, they have different hosts. akamai appears to host all of www.apple.com while the non-www server is hosted directly at 17.142.160.59 (primary), 17.178.96.59 (forwards for a lot of Apple domain names) or 17.172.224.47 (also forwards for a lot of domain names...). Oddly enough, only 17.178.96.59 has a proper certificate, but it's signed with Apple IST CA 2 - G1 from GeoTrust rather than VeriSign used everywhere else. They appear to have a misconfiguration for the other two servers configured in DNS to serve apple.com. Apple IST probably stands for Information Services and Technology group at Apple.
jrochkind1 12y ago
Hmm, I don't seem to get that. While it seems unlikely, could you be getting MitM'ed? Ah wait, are you only getting it on "https://apple.com" https://apple.com"? In my Chrome browser, that immediately redirects to www.apple.com -- but if the first one was self-signed, wouldn't it be untrusted by the browser, and wouldn't the browser refuse to redirect and give me a warning instead? Confused as to if I'm seeing the same thing as you or not.
- quonn 12y ago
  Strange, but someone else saw it, too. Maybe they have fixed it on some of their servers.
  - deleted 12y ago
    [deleted]
- jackweirdy 12y ago
  +1 I only get it without the www; chrome doesn't let me redirect away either
- roghummal 12y ago
  https://apple.com https://apple.com does redirect to https://www.apple.com https://www.apple.com, but it does so with an Apple-issued certificate. Are you running Chrome on OS X? If you use curl/wget/similar on a machine that doesn’t have Apple’s certificates installed the 301 fails (bad cert). "curl: (60) Peer certificate cannot be authenticated with known CA certificates” Oddly, when I first tried to load https://apple.com https://apple.com inside Vienna (OS X RSS reader) it refused to load (bad cert), now it loads fine. Hmmm.
  - dekz 12y ago
    I am using Chrome on OSX and do not get it: https://gist.github.com/dekz/7c911fa633e37fb130d4 https://gist.github.com/dekz/7c911fa633e37fb130d4
  - jrochkind1 12y ago
IgorPartola 12y ago
This is so frustrating. So many sites are still accessible over HTTP. Perhaps some of the security tools out there (a la ssllabs.com) should start giving you a warning, etc. for serving anything but a 301 over HTTP. Also, really, Apple can't figure out how to get a wildcard cert and properly install it? I had an idea at one point to put together an bot to scan and publicly shame Alexa top whatever sites if they don't do HTTPS properly and consistently. Perhaps I should go back to that idea.
- Kiro 12y ago
  Why do all sites need to be HTTPS?
  - sliverstorm 12y ago
    The typical argument is if only sensitive traffic is encrypted, you know that something is worth attacking because it is encrypted. Ergo, encrypt everything, and the sensitive stuff can hide in a sea of meaningless traffic.
    - dwild 12y ago
      There not much I really need to have encrypted, my bank website, my emails, my files on cloud services and my ssh sessions. Anyone that can do a MITM over HTTPS can really easily find the hostname of all theses IP. in fact anyone could find the hostname of theses IP....
      - IgorPartola 12y ago
        And every password and login form you use to protect your passwords. And every government form you fill out (they often require personal identifying info). And every link that links to those forms, etc. There are a lot more ways to attack a connection than just hijacking a cleartext bank password.
        dwild 12y ago
lstamour 12y ago
Apparently you've a 50/50 chance of hitting a self-signed certificate? https://www.ssllabs.com/ssltest/analyze.html?d=apple.com&hideResults=on https://www.ssllabs.com/ssltest/analyze.html?d=apple.com&hid... (Click on each IP address to view the results) Correction: Qualys' tool merges tests of apple.com and www.apple.com. In fact, you've a 66% chance of getting a self-signed certificate, as the IP addresses starting with 17 are the ones serving the non-www apple.com redirect. This is clearly indicated by the "Domain" column of the table, which I apparently completely missed until just now.
- lstamour 12y ago
  Their actual shopping website is less ambiguous: https://www.ssllabs.com/ssltest/analyze.html?d=store.apple.com&hideResults=on https://www.ssllabs.com/ssltest/analyze.html?d=store.apple.c...
Mandatum 12y ago
Well, that's unexpected. You have to visit https://apple.com https://apple.com to hit the self-signed URL.
digitalpacman 12y ago
'oh no'
ahknight 12y ago
Turns out this breaks Xcode documentation and simulator updates, too. Nice job, Apple.

44 points by quonn 12y ago

apple.com currently does not have a valid certificate. Note that I'm accessing the page from Europe, so this is not the issue with China MITM-ing iCloud.

M4v3R 12y ago

Strange. I get that too. Certificate is signed by "Apple IST CA 2 - G1", with 256-bit RSA. Of course accessing their website normally doesn't go through SSL so most people won't see this.

capecodcarl 12y ago

Go to https://www.apple.com https://www.apple.com and not https://apple.com https://apple.com to get the correct site with the proper certificate. apple.com != www.apple.com

quonn 12y ago
I know, but I always just type apple.com. It is still a problem.
- teamhappy 12y ago
  Not anymore. They added a redirect. OS X talks to plenty of apple.com subdomains and there really is no reason not to use self-signed certificates for this kind of thing.
  - alternize 12y ago
    the redirect happens _after_ the certificate warning. to get to the redirect, you have to accept the self signed certificate first. so it might still scare people away, and rightfully so: normal folks cannot distinguish a self signed certificate from a malicious used one f.e. used in phishing attempts.
    - quonn 12y ago
      > normal folks cannot distinguish a self signed certificate from a malicious used one What do you mean with "normal folks"? Nobody can possibly distinguish this, since an attacker would also just use a self-signed certificate.
    - teamhappy 12y ago
      You're right, of course. Did they change the certificate? https://www.sslshopper.com/ssl-checker.html#hostname=apple.com https://www.sslshopper.com/ssl-checker.html#hostname=apple.c... https://www.sslshopper.com/ssl-checker.html#hostname=www.apple.com https://www.sslshopper.com/ssl-checker.html#hostname=www.app...
lstamour 12y ago
Indeed, they have different hosts. akamai appears to host all of www.apple.com while the non-www server is hosted directly at 17.142.160.59 (primary), 17.178.96.59 (forwards for a lot of Apple domain names) or 17.172.224.47 (also forwards for a lot of domain names...). Oddly enough, only 17.178.96.59 has a proper certificate, but it's signed with Apple IST CA 2 - G1 from GeoTrust rather than VeriSign used everywhere else. They appear to have a misconfiguration for the other two servers configured in DNS to serve apple.com. Apple IST probably stands for Information Services and Technology group at Apple.

jrochkind1 12y ago

Hmm, I don't seem to get that. While it seems unlikely, could you be getting MitM'ed? Ah wait, are you only getting it on "https://apple.com" https://apple.com"? In my Chrome browser, that immediately redirects to www.apple.com -- but if the first one was self-signed, wouldn't it be untrusted by the browser, and wouldn't the browser refuse to redirect and give me a warning instead? Confused as to if I'm seeing the same thing as you or not.

quonn 12y ago
Strange, but someone else saw it, too. Maybe they have fixed it on some of their servers.
- deleted 12y ago
  [deleted]
jackweirdy 12y ago
+1 I only get it without the www; chrome doesn't let me redirect away either
roghummal 12y ago
https://apple.com https://apple.com does redirect to https://www.apple.com https://www.apple.com, but it does so with an Apple-issued certificate. Are you running Chrome on OS X? If you use curl/wget/similar on a machine that doesn’t have Apple’s certificates installed the 301 fails (bad cert). "curl: (60) Peer certificate cannot be authenticated with known CA certificates” Oddly, when I first tried to load https://apple.com https://apple.com inside Vienna (OS X RSS reader) it refused to load (bad cert), now it loads fine. Hmmm.
- dekz 12y ago
  I am using Chrome on OSX and do not get it: https://gist.github.com/dekz/7c911fa633e37fb130d4 https://gist.github.com/dekz/7c911fa633e37fb130d4
- jrochkind1 12y ago

IgorPartola 12y ago

This is so frustrating. So many sites are still accessible over HTTP. Perhaps some of the security tools out there (a la ssllabs.com) should start giving you a warning, etc. for serving anything but a 301 over HTTP. Also, really, Apple can't figure out how to get a wildcard cert and properly install it? I had an idea at one point to put together an bot to scan and publicly shame Alexa top whatever sites if they don't do HTTPS properly and consistently. Perhaps I should go back to that idea.

Kiro 12y ago
Why do all sites need to be HTTPS?
- sliverstorm 12y ago
  The typical argument is if only sensitive traffic is encrypted, you know that something is worth attacking because it is encrypted. Ergo, encrypt everything, and the sensitive stuff can hide in a sea of meaningless traffic.
  - dwild 12y ago
    There not much I really need to have encrypted, my bank website, my emails, my files on cloud services and my ssh sessions. Anyone that can do a MITM over HTTPS can really easily find the hostname of all theses IP. in fact anyone could find the hostname of theses IP....
    - IgorPartola 12y ago
      And every password and login form you use to protect your passwords. And every government form you fill out (they often require personal identifying info). And every link that links to those forms, etc. There are a lot more ways to attack a connection than just hijacking a cleartext bank password.
      - dwild 12y ago

lstamour 12y ago

Apparently you've a 50/50 chance of hitting a self-signed certificate? https://www.ssllabs.com/ssltest/analyze.html?d=apple.com&hideResults=on https://www.ssllabs.com/ssltest/analyze.html?d=apple.com&hid... (Click on each IP address to view the results) Correction: Qualys' tool merges tests of apple.com and www.apple.com. In fact, you've a 66% chance of getting a self-signed certificate, as the IP addresses starting with 17 are the ones serving the non-www apple.com redirect. This is clearly indicated by the "Domain" column of the table, which I apparently completely missed until just now.

lstamour 12y ago
Their actual shopping website is less ambiguous: https://www.ssllabs.com/ssltest/analyze.html?d=store.apple.com&hideResults=on https://www.ssllabs.com/ssltest/analyze.html?d=store.apple.c...

Mandatum 12y ago

Well, that's unexpected. You have to visit https://apple.com https://apple.com to hit the self-signed URL.

digitalpacman 12y ago

'oh no'

ahknight 12y ago

Turns out this breaks Xcode documentation and simulator updates, too. Nice job, Apple.