3 ms·
I find it interesting that visiting the https version of cnnic.cn in Chrome neither displays a lock icon nor a warning, but the certificate is displayed as vali
by jtokoph 12y ago
I find it interesting that visiting the https version of cnnic.cn in Chrome neither displays a lock icon nor a warning, but the certificate is displayed as valid: http://i.imgur.com/fTzxpBh.png http://i.imgur.com/fTzxpBh.png
- duskwuff 12y agoRelated to their use of SHA1 on the certificate: http://googleonlinesecurity.blogspot.com/2014/09/gradually-sunsetting-sha-1.html http://googleonlinesecurity.blogspot.com/2014/09/gradually-s...
- geofft 12y agoYup, this is it. The cnnic.cn end-entity certificate is SHA-1, which would do it. (I believe there's some sadness involved like Windows XP being excessively prevalent in China, or something... I vaguely recall a discussion of this on the cabforum public list, but I can't find it now.) If you click on the white page icon and go to the "Connection" tab, it'll say "This site is using outdated security settings," which generally (always, in current Chrome versions?) means SHA-1.
- dsl 12y agoGoogle is explicitly whitelisting the legitimate end-user certificates CNNIC has issued, and then revoking the root. Basically they had to hand over a list of all issued certificates, Google reviewed them, and CNNIC can't issue any new ones without asking Google to whitelist it.