Security Certificate

tonycondon

tonycondon

Gastons CRO (Chief Dinner Reservation Officer)
Joined
Mar 9, 2005
Messages
15,465
Location
Wichita, KS
Display Name
Display name:
Tony
every time i open a post here today, i get a pop up complaining about a sercurity certificate. whats that about?
 
tonycondon said:
every time i open a post here today, i get a pop up complaining about a sercurity certificate. whats that about?
Click to expand...


What is the URL at the top of the window at the time? Can you post a full screenshot including the address bar and the error message?

Also, did it just start today? From home or the office?
 
well,

i opened up jesseweather and got the same pop up, accidently hit "continue" or "accept" or something like that, and now it has quit happening. so I cant give you any specifics.
 
oh! I got it to happen again.

the certificate in question is from paypal.
 
Hmmm on the poa threads in question is there a post by Ted?
 
yep, i just noticed that correlation.

its all teds fault, again.
 
Tony -- could you please take a screenshot of the certificate error you're getting. There really isn't anyhting obvious about his signature...the certificate is valid. I'm thinking your browser might be ultra paranoid.
 
Tony,

This sounds crazy, but could you verify that the date/time is set correctly on your computer?

Is anybody else seeing this happen? Pete, you seemed to zero in on the cause...have you see the warning?
 
FlyNE said:
Tony,

This sounds crazy, but could you verify that the date/time is set correctly on your computer?

Is anybody else seeing this happen? Pete, you seemed to zero in on the cause...have you see the warning?
Click to expand...

When Tony mentioned the PayPal cert I just figured it had to be Ted's donation link. I know he caused trouble in the past.
 
it was on the computer at work, probably a browser issue. i can check tomorrow.
 
Ah! If it's a work computer, you may not have the latest root certificates installed. Entrust, Verisign, and other companies replaced there intermediate certificate authorities in the last year, and the old CA's are expired. If you don't have the new CA certs installed, your browser can't form a certificate chain and will throw an error.

Gobbledy-gook? Let's try a plain-english version.

SSL certificates all chain upwards to a certificate authority. Essentially, your browser comes from Microsoft or Apple or Sun or whoever with certain trusted elements in it. So your browser already "knows" it trusts Andre (for example)

Paypal has a certificate signed by David. David is signed by Charlie, who's signed by Bob, who's signed by... Andre! So your browser will trust the certificate because it can work all the way back to Andre. But in this case, Bob or Charlie got new certificates signed by Anna, who ISN'T embedded in your browser. So once you update your browser (this is something that happens with windows update) root certificates to trust Anna, then you'll once again be able to trust David.

Not sure that was any easier to understand...
 
TMetzinger said:
Ah! If it's a work computer, you may not have the latest root certificates installed. Entrust, Verisign, and other companies replaced there intermediate certificate authorities in the last year, and the old CA's are expired. If you don't have the new CA certs installed, your browser can't form a certificate chain and will throw an error.

Gobbledy-gook? Let's try a plain-english version.

SSL certificates all chain upwards to a certificate authority. Essentially, your browser comes from Microsoft or Apple or Sun or whoever with certain trusted elements in it. So your browser already "knows" it trusts Andre (for example)

Paypal has a certificate signed by David. David is signed by Charlie, who's signed by Bob, who's signed by... Andre! So your browser will trust the certificate because it can work all the way back to Andre. But in this case, Bob or Charlie got new certificates signed by Anna, who ISN'T embedded in your browser. So once you update your browser (this is something that happens with windows update) root certificates to trust Anna, then you'll once again be able to trust David.

Not sure that was any easier to understand...
Click to expand...

I wondered about that, but paypal's certificate is signed by Verisign. THE original CA. I doubt if anything regarding their inclusion has changed since SSL was invented.
 
FlyNE said:
I wondered about that, but paypal's certificate is signed by Verisign. THE original CA. I doubt if anything regarding their inclusion has changed since SSL was invented.
Click to expand...
The root ca hasn't changed, but the intermediate one (the one that signed the Paypal cert) probably has changed.

We got a rash of these incidents at work recently when we renewed our entrust certificates - many of our clients were getting errors that went away when they updated their trusted roots.
 
You must log in or register to reply here.
Back
Top