Ran into an issue earlier today with errors on our internal certificate. Other users/consumers/clients were not getting the errors. Was getting an error "there are issues with the sites certificate chain" and then when viewing the certificate, sure enough just the end certificate was listed, not the whole chain tree. The cert used to work fine after I generated it and installed on our servers a month or so ago and continues to work for my colleagues.
I am on Version 59.0.3071.115 (Official Build) (64-bit) on Ubuntu 14.04.
I resolved the issue on a whim by going to my custom CA settings here chrome://settings/certificates?search=cert and then Authorities and "edit"ing my CA, unchecking all the boxes, pressing okay, then re-editing and re-checking them and pressing okay, no browser restart needed. Next page refresh and my Certificate error was gone!
So this is likely a Chrome bug of some sort and its interaction with NSSDB.
Related
I'm getting a cert error in Chrome hitting an api I'm running locally via Intellij (on a macbook pro). It's not a new project but I was trying to set up self-signed certs and I messed something up.
When I look at the invalid cert in Chrome, it has the name of a cert I deleted. I've searched the drive for the cert (deleted it from Trash), and even grep'd for it. It's not in Intellij that I can tell. I've cleared browser cache and history. Other browsers fail similarly. Not in Intellij's list of certs. It's not in mac's Keychain Access.
I don't see where it's coming from. Is there a way to find out where it's getting the cert from??
I have upgraded my Chrome to 58 and found the secured WebSocket isn't working any more, the console shows (WebSocket connection to 'wss://127.0.0.1:1234/' failed: Error in connection establishment: net::ERR_INSECURE_RESPONSE), I know Google has deprecated the SHA1 certificate, so created a new self-signed certificate with SHA256, but it still doesn't work, so is the self-signed cert not allowed in this scenario? (I'm using "new WebSocket("wss://127.0.0.1:1234")")
It turns out that the certificate should have a subjectAltName with "IP = 127.0.0.1" for my cert to work in Chrome58, not sure if it's a Chrome bug or new requirement
Edit: Please see #Edgar's answer. subjectAltName seems to have become a requirement for self-signed certificates since Chrome 58.
It appears the OP has asked this problem to Google Help Community as well. The response from Google Help Community is:
"I see that you are using Chrome Beta which is an experimental version of Chrome in which new features are tested. I'd recommend to use Chrome Stable which has gotten the full testing and is the updated version. It is the best bet to avoid crashes and other issues."
For now, that should be marked as the correct answer. I just tested wss://localhost on Chrome 59 (Canary/Beta) and it's working.
Note, moving forward, this functionality is subject for removal due to Chromium issue #378566 due to the security implications. For those of us requiring wss:// in this fashion, we should receive deprecation warnings prior to removal. As of Chrome 59 (Canary/Beta), this deprecation is not present.
When i tried to open my site (https://thaimeditationcenter.com/) by Google Chrome on My mac using macOS Sierra Version 10.12 i got an error like this.
Your connection is not private
Attackers might be trying to steal your information from thaimeditationcenter.com
(for example, passwords, messages, or credit cards). NET::ERR_CERT_AUTHORITY_INVALID
Automatically report details of possible security incidents to Google. Privacy policy
But when i open it on Firefox , Safari or Google chrome on my Iphone it seems fine there was no error at all.
How can i fix this?
Thanks!
According to SSLLabs your site is not configured properly:
Chain issues Incomplete
This means that a chain certificates is missing. Some browsers cache chain certificates when visiting other sites and therefore can work around this problem. Other browsers try to download the missing chain certificate. The rest will fail because the trust chain cannot be built.
To fix this you need to add the missing chain certificate to your server configuration. While doing that you should probably also fix all the other problems shown by the SSLLabs report which lead to a bad Grade F for your site.
I have been having an issue lately with Google Chrome. Some sites, seems to be completely random, are returning a 503 Service Unavailable error message. The last one I received was from my hosting provider when trying to access my CPanel. I can access the same URL completely fine in Firefox or IE. It seems to be isolated to Chrome.
I have tried the following:
Disabled all extensions
Logged in/out of my Google account
Cleared all cache and history
So far, nothing seems to correct the issue. It's becoming more and more aggravating from what was once a pretty reliable browser.
I am running:
Windows 7
Chrome Version 36.0.1985.143 m
I was hitting the same issue. Mostly, it would occur on intranet sites at work, but it happened with a few exterior sites. Loading in IE Tab would work fine.
I was able to solve the issue by upgrading to 64-bit Chrome. I'm not sure why that fixed it, but I think it had something to do with a conflict between Java and Chrome (It looks like I have both 64bit and 32bit Java installed side-by-side).
My solution:
Uninstall Chrome with clear personal data option selected
Install Chrome again but without admin right (install for your personal
user)
Use Chrome as normal
I've got a web site that uses SSL Client certificate authorization.
All client certificates are generated using OpenSSL and are self-signed. Everything worked with all web-browsers, but the recommended one was Google Chrome, because it uses same SSL warehouse as IE, so certificate installation was pretty easy (click-click-password-done!).
After last update of Google "Chrome 29.0.1547.57 m", noone can access my web-server, even me.
Google chrome error only! IE and FF working fine.
Error is: ERR_SSL_CLIENT_AUTH_SIGNATURE_FAILED.
Same in server error log.
Do you have any suggestions?
The problem is that most part of clients are non familiar with PC's and they got very frightened about that situation. So phone support guys are under the wave of calls.
We are experiencing the same problem. As Sean has reported, it seems that Chrome on Windows XP
negotiates TLSv1.2 even though the operating system does not support SHA-2 (say, SHA-256 or SHA-384)
hash function.
We found that Chrome fails when it receives "client certificate request" following SERVER HELLO.
SERVER HELLO itself negotiates RC4-SHA1 (in our environment) which should succeeds. The problematic
packet seems the "client certificate request" that includes SHA-2 (as well as SHA1) functions for hashes.
Invoking Chrome with "--enable-logging --log-level=0" outputs the following message:
ERROR:nss_ssl_util.cc(193)] ERR_SSL_CLIENT_AUTH_SIGNATURE_FAILED: NSS error -12222, OS error -2146893816
This is an Operating system error corresponding "NTE_BAD_ALGID" for CryptSignHash function:
http://msdn.microsoft.com/en-us/library/windows/desktop/aa380280(v=vs.85).aspx
Disabling TLSv1.2 on the server should fix the problem. But I think Chrome should prefer SHA1 on Windows XP.
I'm experiencing the same thing here with Windows7 client systems unable to authenticate with client certificates against some of our systems, but not others. The affected servers are running Apache Tomcat while the unaffected are running IIS7, though I'm hesitant to identify that difference as the culprit.
Anyone else seeing this?
EDIT:
I'm able to eliminate the problem by disabling TLSv1.2 on the server. Is anyone else able to replicate this experience?
I would also be interested to know whether anyone else is seeing this on anything but the Windows platform, as it's the only place it's happening here (same version OSX has no issues).
EDIT2:
Chrome Bug Report here: https://code.google.com/p/chromium/issues/detail?id=278370
EDIT3:
Should be working again in latest Chrome stable. Chrome 30 will have a more robust fix, but 29.x should also work now.
I recently had a similar issue in Chrome on Mac OS. It worked fine with Firefox, but started failing in Chrome and Safari after changing my corporate (AD) credentials -- I guess the issue was a mismatch between system creds and the keychain creds.
The solution for me was a reset of the private key(s) access permissions in the Keychain Access app.
To do the reset:
In Keychain Access app right-click each private key that fails and select "Get Info".
Go to "Access Control" tab and set "Allow all applications to access this item" -- click on that option even if it's already set. Then click Save Changes.
Refresh the website that fails and you should be prompted to enter keychain password -- enter it and select Allow Always.
It is combination of Win XP and Google Chrome 29.0.1547.57 m
On Win 7/8 this problem doesn't occur.
You could install older working version 28.0.1500.95
http://www.filehippo.com/download_google_chrome/15657/
But settings for disabling updating are not so easy.
http://dev.chromium.org/administrators/turning-off-auto-updates
The problem is caused by Chrome running TLSv1.2 on Windows XP.
This can be disabled on the server side but also on the client side.
To run Chrome with a lower version of TLS, start it with the command-line option --ssl-version-max=tls1.1
I had this problem Connecting Chrome with WebSockets to apache throw proxy_wstunnel_module.
My solution was configuring httpd.conf
ProxyPass /wss2/ ws://127.0.0.1:8080/ retry=0 keepalive=On
ProxyPassReverse /wss2/ ws://127.0.0.1:8080/ retry=0
<Location /wss2/>
SSLRequireSSL On
SSLVerifyClient none
SSLVerifyDepth 1
SSLOptions +StdEnvVars +StrictRequire
SSLRenegBufferSize 10486000
</Location>
Chrome WebSockets does not like the parameter SSLVerifyClient optional
I hope this helps.