FN-GM Posted April 25, 2017 Posted April 25, 2017 Hello, Chrome has started moaning that one of our certificates doesn't have any subject alternate names. It doesn't need any! Has anyone else seen this please? Thanks
Arthur Posted April 25, 2017 Posted April 25, 2017 Has anyone else seen this please? Yes. www.reddit.com/r/sysadmin/comments/66clon/chrome_58_displays_an_untrusted_warning_for_certs/ There's a temporary workaround... www.chromium.org/administrators/policy-list-3#EnableCommonNameFallbackForLocalAnchors 1
rogerdnixon Posted April 25, 2017 Posted April 25, 2017 See this: https://bugs.chromium.org/p/chromium/issues/detail?id=700595&desc=2#c20 We had this on the beta and dev channel a while back until Securly updated things their end prior to the stable release of 58.
FN-GM Posted April 25, 2017 Author Posted April 25, 2017 So its not supposed to be like this and its a bug that will be fixed? thanks
Arthur Posted April 25, 2017 Posted April 25, 2017 (edited) it's a bug that will be fixed? It's not a bug in Chrome. It's a feature... https://www.chromestatus.com/feature/4981025180483584 https://groups.google.com/a/chromium.org/forum/m/#!topic/security-dev/IGT2fLJrAeo Edited April 25, 2017 by Arthur
hudzen76 Posted April 25, 2017 Posted April 25, 2017 Yep, having fun here with it. Have downloaded the latest Chrome ADMX files and updated central policy store, then set the "Whether to allow certificates issued by local trust anchors that are missing the subjectAlternativeName extension" to enabled. Now it asks you to login when you try to access intranet homepage, so have sent out email telling staff that it's fine to put username in in this situation but at least they can get to it. Fun.
Jaan Posted April 25, 2017 Posted April 25, 2017 Yep i fixed it using the above method also: http://www.edugeek.net/forums/internet-related-filtering-firewall/182708-google-not-secure-your-connection-not-private-2.html
pete Posted April 25, 2017 Posted April 25, 2017 Yup, I had to regenerate a couple of internal certs to include the SAN attribute the other day.
sparkeh Posted April 26, 2017 Posted April 26, 2017 Oh great, loads of reports of Chrome certificate problems today. As if I don't have enough to do. Thanks for info and solutions.
Wave9_Lee Posted April 26, 2017 Posted April 26, 2017 Nice of Google to look after us all... Here's a link for the Sophos workaround, but likely to be a more permanent fix soon. We are working with our clients to make the changes needed where necessary https://community.sophos.com/products/unified-threat-management/f/general-discussion/91085/https-scanning-web-protection-ssl-error-err_cert_common_name_invalid/330113 1
DecadentLabs Posted April 26, 2017 Posted April 26, 2017 It's issues like these that assure me that certificate-less SSL/TLS filtering is the absolute best way to go. Why waste time and bandwidth dealing with loading and staying up to date with 3rd party certs when there are solutions out there that filter as good, if not better, without having to inspect HTTPS traffic? Seems a bit silly to me to not only waste time, but to also bring about security issues with "trusted" MITM approaches...
FN-GM Posted April 26, 2017 Author Posted April 26, 2017 It's issues like these that assure me that certificate-less SSL/TLS filtering is the absolute best way to go. Why waste time and bandwidth dealing with loading and staying up to date with 3rd party certs when there are solutions out there that filter as good, if not better, without having to inspect HTTPS traffic? Seems a bit silly to me to not only waste time, but to also bring about security issues with "trusted" MITM approaches... I am not using SSL filtering and have this issue.
dhicks Posted April 26, 2017 Posted April 26, 2017 It's issues like these that assure me that certificate-less SSL/TLS filtering is the absolute best way to go. Can you expand on what certificate-less SSL/TLS filtering is and how we might go about implementing it on a typical school network?
DecadentLabs Posted April 26, 2017 Posted April 26, 2017 I am not using SSL filtering and have this issue. That doesn't make much sense, as certificates are only used for SSL/TLS (HTTPS) traffic. I don't see how you would be getting a certificate error if you aren't using certificates?
FN-GM Posted April 26, 2017 Author Posted April 26, 2017 That doesn't make much sense, as certificates are only used for SSL/TLS (HTTPS) traffic. I don't see how you would be getting a certificate error if you aren't using certificates? I didn't say I wasn't using the certificates, I said im not using HTTPS filtering. They have been issued by my own internal CA for use on Intranet websites.
sparkeh Posted April 26, 2017 Posted April 26, 2017 So I had a quick look and Aristotle seems to be an Impero style product and utilises a client to do the filtering? Can't say I'd be too chuffed with that. What about guests or large byod schemes? The website over eggs the complexity of traditional filtering solutions. SSL decrypt and inspect isn't that difficult or expensive (resource wise). This issue is irritating but ultimately will blow over. Filter providers will sort it out and Chrome users can use a different browser for a bit. No biggie. I would hazard a guess that there is a reason that all major filtering providers do it the traditional way.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now