Jump to content

SSL Certificate Revoked Issue

Anjunabeat

By Anjunabeat
in Cloud Services

 Share

Recommended Posts

Anjunabeat

Anjunabeat

Posted
Posted

Hi all.

 

Just a quick one... If you've got any certs signed by AlphaSSL/GlobalSign you may be experiencing some certificate revocation issues. You can get updates here.

 

 

Cheers.

  • Thanks 3
TechMonkey

TechMonkey

Posted
Posted
Ha, why didn't I just search EduGek first. Been struggling with this and finally thought I wonder if anyone has ever had this issue before on EduGeek. We are still suffering from the issue even after having run their "fix".
fiza

fiza

Posted
Posted (edited)
Ha, why didn't I just search EduGek first. Been struggling with this and finally thought I wonder if anyone has ever had this issue before on EduGeek. We are still suffering from the issue even after having run their "fix".

 

I just cleared the cache in Chrome & IE, fixed Chrome but IE still doesnt display the page.

I then used their fix but IE still doesnt display the page.

Edited by fiza
fiza

fiza

Posted
Posted
:mad: just stopped working again. I have one tab open to the site I want and try to open it in another and same certificate error message.
timbo343

timbo343

Posted
Posted (edited)

Is anyone still experiencing this? I've been on to Sisra about it as they have the problem, They've told me to run certutil -urlcache * delete as described on GlobalSign's twitter feed however this hasn't worked.

 

We are running a smoothwall an i wonder if there's a way to clear the cache on it.

 

EDIT: its working now, this morning at 7:56 trying the urlcache command didnt work. Ive just run it again and sisra is now working.

Edited by timbo343
Arthur

Arthur

Posted
Posted

How a chunk of the web disappeared this week: GlobalSign's global HTTPS snafu explained

 

GlobalSign has performed a postmortem examination on how, as one of the world's root certificate authorities, it managed to break a chunk of the web.

 

The New Hampshire, US-based biz has to date sold 2.5 million SSL/TLS certificates to websites around the world. This week, it inadvertently smashed its own chain of trust: it effectively made its customers' certs appear untrustworthy in the eyes of web browsers and apps globally.

 

This prevented many people from being able to access secure websites and online services large and small, from Wikipedia and the Financial Times to GlobalSign's own servers.

 

The accidental cockup hasn't affected everyone: if your computer, phone or some other gadget was among the unlucky ones to fetch a dodgy revocation list from GlobalSign's network on Thursday, October 13, your browser will stop you from accessing legit HTTPS websites. That's because your browser has been told GlobalSign-issued encryption certificates are no longer valid.

 

Tech-savvy netizens hit by the blunder can attempt to clear their revocation list caches and fetch a correction from GlobalSign to fix the problem. Less savvy folks affected are left with baffling browser error messages. If you're not seeing any complaints on your screen when browsing the web, your computer or phone may have picked up the correction by now, you may be visiting websites that do not use GlobalSign certificates, or your browser managed to dodge the small crisis entirely.

 

Tech details

Initially, GlobalSign blamed a programming flaw in web browsers for the cockup – then it realized the problem was within its own systems.

 

We're told it all kicked off after GlobalSign published a Certificate Revocation List, signed by the organization's Root CA R2 cert, that revoked a cross-certificate and an old subordinate CA that was being discontinued – the subordinate was used to issue out-dated SHA1 Extended Validation SSL certificates.

 

A cross-certificate can, generally speaking, be used to improve trust and reliability: in GlobalSign's case, the cross-cert allows browsers and apps to verify the integrity of a GlobalSign-issued HTTPS certificate with either GlobalSign's Root CA R1 or Root CA R2 certificate.

 

The cross-cert therefore creates two possible paths of trust for software to walk along when checking the validity of a website's HTTPS cert. As long as the browser trusts either GlobalSign's Root CA R1 or R2, it will trust the site's HTTPS cert at the end of the chain.

 

Here's what GlobalSign was trying to revoke – just the cross-certificate and an old subordinate CA:

 

TXzbFP.jpg

 

The cross-cert was issued by GlobalSign's Root CA R2 with the Root CA R1 as the subject. On October 13, six days after the revocation list was published, the org updated a database called the delegated Online Certificate Status Protocol (OCSP) responder database. This feeds information to a collection of systems called the delegated revocation responders.

 

Unexpectedly, these responders were confused by the revocation of the cross-certificate, and thought GlobalSign was trying to revoke the intermediate certificates linked to the Root CA R1 certificate. These intermediates are used to issue SSL/TLS certificates sold to websites and businesses: by revoking the intermediates, all those customer certs become untrusted – they are effectively null and void. Browsers can no longer verify the identity of secure sites using the GlobalSign certificates, because the chain of trust has been broken, and thus refuse to access the websites.

 

xaBQi1.jpg

Arthur

Arthur

Posted
Posted
Has the issue been fixed now please?

It depends. From the article above...

 

The biz warns it may take until early next week for the problem to be cleared up completely due to the amount of caching involved and the fact that applications tend to check for updates to revocation lists once every four days. If your software was stung on Thursday, it may not get the antidote until Monday.
timbo343

timbo343

Posted
Posted

This is what i found since friday with screen shots.

 

001 = before running the certutil command with Chrome / IE / Edge

002 = once the command had run, closed all browsers and reopened one by one. Chrome first - browsed to sisraobserve, then IE then edge. IE and Edge didnt work.

003 = Closed all browsers again, DID NOT re-run the certutil command. All 3 browsers dont work.

 

If i hadn't had opened IE or EDGE and browsed to sisraobserve, Chrome would still be working.

 

Firefox works a treat though.

003.PNG

002.PNG

001.PNG

TechMonkey

TechMonkey

Posted
Posted
Replacing the Intermediary cert has worked on most of ours, we did have to reimport the SSL Cert to IIS though. The only server we have not been able to solve is our PBX that I can't work out how to replace just the Intermediary. It isn't stopping us access it though so I am going to wait till tomorrow to see if the 4 day time frame works.
ITGURU

ITGURU

Posted
Posted

It's a caching issue if you still cannot get on as our Finance department use an RDP session and couldn't remote on due to the certificate being revoked. Clearing IE didn't work, we just had to wait for the cache to auto clear and they are back in.

 

Dear All,

 

Due to an error made by GlobalSign, the leading international supplier of Secure Website Certificates, several websites have issues with users connecting, these include The Financial Times, Wikipedia and unfortunately some PS Financials Cloud Users.

 

GlobalSign have now corrected their error and connection should continue as usual, however if connection was made during the time this issue existed your Cache may continue to stop the connection being made.

 

Currently the only work around we have whilst we wait for the Cache to be cleared is to try to connect from a different machine.

 

More information can be found here:

 

GlobalSign screw-up cancels top websites' HTTPS certificates ? The Register

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share
Go to topic listing


×
×
  • Create New...