SSL Certificate Revoked Issue

Hi all.

Just a quick one... If you've got any certs signed by AlphaSSL/GlobalSign you may be experiencing some certificate revocation issues. You can get updates here.

Cheers.

We use LGfL and the atomwide site stopped working for me. This explains it.

Thanks

Ha, why didn't I just search EduGek first. Been struggling with this and finally thought I wonder if anyone has ever had this issue before on EduGeek. We are still suffering from the issue even after having run their "fix".

I just cleared the cache in Chrome & IE, fixed Chrome but IE still doesnt display the page.

I then used their fix but IE still doesnt display the page.

Is anyone still experiencing this? I've been on to Sisra about it as they have the problem, They've told me to run certutil -urlcache * delete as described on GlobalSign's twitter feed however this hasn't worked.

We are running a smoothwall an i wonder if there's a way to clear the cache on it.

EDIT: its working now, this morning at 7:56 trying the urlcache command didnt work. Ive just run it again and sisra is now working.

How a chunk of the web disappeared this week: GlobalSign's global HTTPS snafu explained

GlobalSign has performed a postmortem examination on how, as one of the world's root certificate authorities, it managed to break a chunk of the web.

 

The New Hampshire, US-based biz has to date sold 2.5 million SSL/TLS certificates to websites around the world. This week, it inadvertently smashed its own chain of trust: it effectively made its customers' certs appear untrustworthy in the eyes of web browsers and apps globally.

 

This prevented many people from being able to access secure websites and online services large and small, from Wikipedia and the Financial Times to GlobalSign's own servers.

 

The accidental cockup hasn't affected everyone: if your computer, phone or some other gadget was among the unlucky ones to fetch a dodgy revocation list from GlobalSign's network on Thursday, October 13, your browser will stop you from accessing legit HTTPS websites. That's because your browser has been told GlobalSign-issued encryption certificates are no longer valid.

 

Tech-savvy netizens hit by the blunder can attempt to clear their revocation list caches and fetch a correction from GlobalSign to fix the problem. Less savvy folks affected are left with baffling browser error messages. If you're not seeing any complaints on your screen when browsing the web, your computer or phone may have picked up the correction by now, you may be visiting websites that do not use GlobalSign certificates, or your browser managed to dodge the small crisis entirely.

 

Tech details

Initially, GlobalSign blamed a programming flaw in web browsers for the cockup – then it realized the problem was within its own systems.

 

We're told it all kicked off after GlobalSign published a Certificate Revocation List, signed by the organization's Root CA R2 cert, that revoked a cross-certificate and an old subordinate CA that was being discontinued – the subordinate was used to issue out-dated SHA1 Extended Validation SSL certificates.

 

A cross-certificate can, generally speaking, be used to improve trust and reliability: in GlobalSign's case, the cross-cert allows browsers and apps to verify the integrity of a GlobalSign-issued HTTPS certificate with either GlobalSign's Root CA R1 or Root CA R2 certificate.

 

The cross-cert therefore creates two possible paths of trust for software to walk along when checking the validity of a website's HTTPS cert. As long as the browser trusts either GlobalSign's Root CA R1 or R2, it will trust the site's HTTPS cert at the end of the chain.

 

Here's what GlobalSign was trying to revoke – just the cross-certificate and an old subordinate CA:

The cross-cert was issued by GlobalSign's Root CA R2 with the Root CA R1 as the subject. On October 13, six days after the revocation list was published, the org updated a database called the delegated Online Certificate Status Protocol (OCSP) responder database. This feeds information to a collection of systems called the delegated revocation responders.

 

Unexpectedly, these responders were confused by the revocation of the cross-certificate, and thought GlobalSign was trying to revoke the intermediate certificates linked to the Root CA R1 certificate. These intermediates are used to issue SSL/TLS certificates sold to websites and businesses: by revoking the intermediates, all those customer certs become untrusted – they are effectively null and void. Browsers can no longer verify the identity of secure sites using the GlobalSign certificates, because the chain of trust has been broken, and thus refuse to access the websites.

Has the issue been fixed now please?

It depends. From the article above...

The biz warns it may take until early next week for the problem to be cleared up completely due to the amount of caching involved and the fact that applications tend to check for updates to revocation lists once every four days. If your software was stung on Thursday, it may not get the antidote until Monday.

Mac users can run the following command to clear their OCSP cache.

sqlite3 ~/Library/Keychains/*/ocspcache.sqlite3 'DELETE FROM ocsp;'

I found that chrome worked fine after running the delete urlcache however IE / edge didnt work.

How do you find this please?

How do you find this please?

@FN-GM https://support.globalsign.com/customer/portal/articles/1353318-view-and-or-delete-crl-ocsp-cache

This is what i found since friday with screen shots.

001 = before running the certutil command with Chrome / IE / Edge

002 = once the command had run, closed all browsers and reopened one by one. Chrome first - browsed to sisraobserve, then IE then edge. IE and Edge didnt work.

003 = Closed all browsers again, DID NOT re-run the certutil command. All 3 browsers dont work.

If i hadn't had opened IE or EDGE and browsed to sisraobserve, Chrome would still be working.

Firefox works a treat though.

If I install the certifciate as a trusted root certificate do you think it will get around the issue?

Thanks

Globalsign recommend that their customers (and the people who use them such as AlphaSSL) replace the intermediary CA certificates on their servers - https://support.globalsign.com/customer/portal/articles/2599710-ocsp-revocation-errors-troubleshooting-guide

I did this this morning for our helpdesk SSL cert, and everything is working fine again.

Globalsign recommend that their customers (and the people who use them such as AlphaSSL) replace the intermediary CA certificates on their servers - https://support.globalsign.com/customer/portal/articles/2599710-ocsp-revocation-errors-troubleshooting-guide

 

I did this this morning for our helpdesk SSL cert, and everything is working fine again.

This works! - However its a PITA!

It's a caching issue if you still cannot get on as our Finance department use an RDP session and couldn't remote on due to the certificate being revoked. Clearing IE didn't work, we just had to wait for the cache to auto clear and they are back in.

Dear All,

Due to an error made by GlobalSign, the leading international supplier of Secure Website Certificates, several websites have issues with users connecting, these include The Financial Times, Wikipedia and unfortunately some PS Financials Cloud Users.

GlobalSign have now corrected their error and connection should continue as usual, however if connection was made during the time this issue existed your Cache may continue to stop the connection being made.

Currently the only work around we have whilst we wait for the Cache to be cleared is to try to connect from a different machine.

More information can be found here:

GlobalSign screw-up cancels top websites' HTTPS certificates ? The Register

We has problem logging in to our O365 email, followed this link and all working ok.

https://support.globalsign.com/customer/portal/articles/1353318