4 ms·

Correct me if I'm wrong, but -sha256 during CSR creation is meaningless in regards to the Chrome issue as Chrome will never see the hash that was used then crea

by pilif 12y ago

Correct me if I'm wrong, but -sha256 during CSR creation is meaningless in regards to the Chrome issue as Chrome will never see the hash that was used then creating the CSR. All Chrome cares about is the signature used by the CA. Now of course a CA could (and should) complain about sha-1 signed CSR, but this has nothing to do with the Chrome sha-1 deprecation.

arenaninja 12y ago
Is that correct? I setup a certificate for www.healthlabs.com last week, and we found that we don't get the EV (browser green bar) on Chrome browser in ChromeOS. No other browser is complaining, and I've been scratching my head why. It would make sense if Chrome is complaining about the CA and not us, unfortunately it's not a point that I can argue with customers
- pilif 12y ago
  my chrome is happy with your domain and is showing a green bar. SSL Labs agrees with that assessment, though you could enable PFS for a better rank: https://www.ssllabs.com/ssltest/analyze.html?d=healthlabs.com https://www.ssllabs.com/ssltest/analyze.html?d=healthlabs.co... I don't have a Chrome OS to test with, but I'd say this is not your fault. Now of course, going to the customer and saying that a random stranger on the internet told you that it's ok is probably not going to impress anybody :-)
- ryan-c 12y ago
  It's correct. The signature on the CSR is not used in the actual certificate.
- Buge 12y ago
  Your DHE key is 1024 bits. I'm not sure if that's what's causing it, but I would recommend to upgrade it to 2048 bits.
- acveilleux 12y ago
  One of the 2 intermediate CA on your cert path is signed with SHA-1: VeriSign Class 3 Public Primary Certification Authority - G5 In addition, in my Chrome for Linux browser (Version 41.0.2272.101 (64-bit)), that cert's parent cert is: Class 3 Public Primary Certification Authority And that's a 1024 bit RSA key. So my chrome's validation path includes a signature by a 1024 bits RSA key using SHA-1 as a trust step. No EV for you. Had the G5 cert been in my trust store (might be on your platform) then all the signatures would have been from 2048-bits RSA keys with SHA-256 and all A-OK.
  - yuhong 12y ago
    I think this is because of a bug in older versions of NSS.
baby 12y ago
So what is -sha256 doing?
- pilif 12y ago
  It's telling openssl to sign the CSR with sha256, making it much harder for somebody to modify your CSR in transit to the CA. That's ok, but that's not relevant at all what the resulting certificate is concerned.
nailer 12y ago
Thanks Pilif, you're correct - I've fixed that section and credited you and brians.

by pilif 12y ago

arenaninja 12y ago

Is that correct? I setup a certificate for www.healthlabs.com last week, and we found that we don't get the EV (browser green bar) on Chrome browser in ChromeOS. No other browser is complaining, and I've been scratching my head why. It would make sense if Chrome is complaining about the CA and not us, unfortunately it's not a point that I can argue with customers

pilif 12y ago
my chrome is happy with your domain and is showing a green bar. SSL Labs agrees with that assessment, though you could enable PFS for a better rank: https://www.ssllabs.com/ssltest/analyze.html?d=healthlabs.com https://www.ssllabs.com/ssltest/analyze.html?d=healthlabs.co... I don't have a Chrome OS to test with, but I'd say this is not your fault. Now of course, going to the customer and saying that a random stranger on the internet told you that it's ok is probably not going to impress anybody :-)
ryan-c 12y ago
It's correct. The signature on the CSR is not used in the actual certificate.
Buge 12y ago
Your DHE key is 1024 bits. I'm not sure if that's what's causing it, but I would recommend to upgrade it to 2048 bits.
acveilleux 12y ago
One of the 2 intermediate CA on your cert path is signed with SHA-1: VeriSign Class 3 Public Primary Certification Authority - G5 In addition, in my Chrome for Linux browser (Version 41.0.2272.101 (64-bit)), that cert's parent cert is: Class 3 Public Primary Certification Authority And that's a 1024 bit RSA key. So my chrome's validation path includes a signature by a 1024 bits RSA key using SHA-1 as a trust step. No EV for you. Had the G5 cert been in my trust store (might be on your platform) then all the signatures would have been from 2048-bits RSA keys with SHA-256 and all A-OK.
- yuhong 12y ago
  I think this is because of a bug in older versions of NSS.

baby 12y ago

So what is -sha256 doing?

pilif 12y ago
It's telling openssl to sign the CSR with sha256, making it much harder for somebody to modify your CSR in transit to the CA. That's ok, but that's not relevant at all what the resulting certificate is concerned.

nailer 12y ago

Thanks Pilif, you're correct - I've fixed that section and credited you and brians.