3 ms·

Is that correct? I setup a certificate for www.healthlabs.com last week, and we found that we don't get the EV (browser green bar) on Chrome browser in ChromeOS

Is that correct? I setup a certificate for www.healthlabs.com last week, and we found that we don't get the EV (browser green bar) on Chrome browser in ChromeOS. No other browser is complaining, and I've been scratching my head why. It would make sense if Chrome is complaining about the CA and not us, unfortunately it's not a point that I can argue with customers

pilif 12y ago
my chrome is happy with your domain and is showing a green bar. SSL Labs agrees with that assessment, though you could enable PFS for a better rank: https://www.ssllabs.com/ssltest/analyze.html?d=healthlabs.com https://www.ssllabs.com/ssltest/analyze.html?d=healthlabs.co... I don't have a Chrome OS to test with, but I'd say this is not your fault. Now of course, going to the customer and saying that a random stranger on the internet told you that it's ok is probably not going to impress anybody :-)
ryan-c 12y ago
It's correct. The signature on the CSR is not used in the actual certificate.
Buge 12y ago
Your DHE key is 1024 bits. I'm not sure if that's what's causing it, but I would recommend to upgrade it to 2048 bits.
acveilleux 12y ago
One of the 2 intermediate CA on your cert path is signed with SHA-1: VeriSign Class 3 Public Primary Certification Authority - G5 In addition, in my Chrome for Linux browser (Version 41.0.2272.101 (64-bit)), that cert's parent cert is: Class 3 Public Primary Certification Authority And that's a 1024 bit RSA key. So my chrome's validation path includes a signature by a 1024 bits RSA key using SHA-1 as a trust step. No EV for you. Had the G5 cert been in my trust store (might be on your platform) then all the signatures would have been from 2048-bits RSA keys with SHA-256 and all A-OK.
- yuhong 12y ago
  I think this is because of a bug in older versions of NSS.

3 ms·

Is that correct? I setup a certificate for www.healthlabs.com last week, and we found that we don't get the EV (browser green bar) on Chrome browser in ChromeOS

by arenaninja 12y ago

pilif 12y ago
my chrome is happy with your domain and is showing a green bar. SSL Labs agrees with that assessment, though you could enable PFS for a better rank: https://www.ssllabs.com/ssltest/analyze.html?d=healthlabs.com https://www.ssllabs.com/ssltest/analyze.html?d=healthlabs.co... I don't have a Chrome OS to test with, but I'd say this is not your fault. Now of course, going to the customer and saying that a random stranger on the internet told you that it's ok is probably not going to impress anybody :-)
ryan-c 12y ago
It's correct. The signature on the CSR is not used in the actual certificate.
Buge 12y ago
Your DHE key is 1024 bits. I'm not sure if that's what's causing it, but I would recommend to upgrade it to 2048 bits.
acveilleux 12y ago
One of the 2 intermediate CA on your cert path is signed with SHA-1: VeriSign Class 3 Public Primary Certification Authority - G5 In addition, in my Chrome for Linux browser (Version 41.0.2272.101 (64-bit)), that cert's parent cert is: Class 3 Public Primary Certification Authority And that's a 1024 bit RSA key. So my chrome's validation path includes a signature by a 1024 bits RSA key using SHA-1 as a trust step. No EV for you. Had the G5 cert been in my trust store (might be on your platform) then all the signatures would have been from 2048-bits RSA keys with SHA-256 and all A-OK.
- yuhong 12y ago
  I think this is because of a bug in older versions of NSS.