Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate

sslmate.com

Post reply on HN
Print view View original

21–30 of 95 posts

Re: Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate

#22

Post by agwa »

Author here. It has gotten kind of hard to follow what has happened, so here's a chronology:

1. In September, Chrome 53 was released, which enabled mandatory Certificate Transparency for Symantec certificates due to Symantec's history of incompetence. Some website operators, such as Chase, asked Symantec to submit their certificates to Certificate Transparency logs in such a way that the certificate wouldn't be trusted by Chrome, triggering the ERR_CERTIFICATE_TRANSPARENCY_REQUIRED error. This is when I wrote this blog post.

2. Last week, an internal timebomb expired in older versions of Chrome causing this error message for any website using a Symantec certificate issued since June. Basically, Chrome contains a list of Certificate Transparency logs that it trusts, and this list has a 10 week expiration date. So if Chrome was built more than 10 weeks ago, there would be no trusted Certificate Transparency logs, and therefore any certificate that was supposed to be logged (such as new Symantec certs) would be untrusted and display this error message. The Chrome team was able to fix this within 24 hours by remotely disabling CT enforcement in Chrome. (When Chrome starts up, it fetches a list of feature flags from a Chrome server using a system called Finch which is independent of the normal upgrade system.)

3. Today, the Chromium packages in several Linux distros, including Ubuntu, became 10 weeks old. For some reason, they have not picked up the Finch update, and so they are displaying this error message for all Symantec certificates issued since June. This is not confirmed yet, but the current hypothesis is that the distros have disabled Finch for privacy reasons. It will probably require a distro package upgrade to fix.

Re: Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate

#24

Post by swalsh »

agwa wrote: post #22

Author here. It has gotten kind of hard to follow what has happened, so here's a chronology: 1. In September, Chrome 53 was released, which enabled mandatory Certificate Transparency for Symantec certificates due to Symantec's history of incompetence. Some website operators, such as Chase, asked Symantec to submit their certificates to Certificate Transparency logs in such a way that the certificate wouldn't be trust…

Is there any reason, in 2016, to use Symantec over LetsEncrypt?

Re: Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate

#25

Post by xyzzy123 »

swalsh wrote: post #24
agwa wrote: post #22

Author here. It has gotten kind of hard to follow what has happened, so here's a chronology: 1. In September, Chrome 53 was released, which enabled mandatory Certificate Transparency for Symantec certificates due to Symantec's history of incompetence. Some website operators, such as Chase, asked Symantec to submit their certificates to Certificate Transparency logs in such a way that the certificate wouldn't be trust…

Is there any reason, in 2016, to use Symantec over LetsEncrypt?

extended validation (mandatory for bigcos) and support contracts (important for corporates, not sure how useful "in real life").

Also, inventory management, which is helpful when you have hundreds or thousands of certs.

Re: Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate

#26

Post by [deleted] »

swalsh wrote: post #24
agwa wrote: post #22

Author here. It has gotten kind of hard to follow what has happened, so here's a chronology: 1. In September, Chrome 53 was released, which enabled mandatory Certificate Transparency for Symantec certificates due to Symantec's history of incompetence. Some website operators, such as Chase, asked Symantec to submit their certificates to Certificate Transparency logs in such a way that the certificate wouldn't be trust…

Is there any reason, in 2016, to use Symantec over LetsEncrypt?

[deleted]

Re: Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate

#27

Post by jlgaddis »

robertelder wrote: post #4

I'm using Chromium on Ubuntu 16, and I've been trying to visit https://www.nist.gov/ but I don't even get an option to 'browse insecurely' under the 'Advanced' link. In my experience that past couple days, I get the warning on about 10-25% of major web sites.

I get the error on the NIST web site [0] as well. I do have the "Proceed to ..." option, though, as you can see in my screenshot [1].

The same thing happens on the Chase Bank URL [2] mentioned in the article. Clicking "Proceed to ..." then redirects me to another URL [3] which throws up the same error. If I click "Proceed to ..." on that URL, I then get an ironic login page [4].

  $ lsb_release -d
  Description:    Ubuntu 16.04.1 LTS

  $ apt show chromium-browser | grep ^Version
  Version: 53.0.2785.143-0ubuntu0.16.04.1.1254

  $ chromium-browser --version
  Chromium 53.0.2785.143 Built on Ubuntu , running on Ubuntu 16.04
Perhaps there's a setting somewhere that you've toggled? Maybe it's HSTS or something similar?

[0]: https://www.nist.gov/

[1]: http://i.imgur.com/QbgBxyB.png

[2]: https://choosemyreward.chase.com/

[3]: https://chaseonline.chase.com/Logon.aspx

[4]: http://i.imgur.com/KFqiwNG.png

Re: Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate

#28

Post by aidos »

dijit wrote: post #5
robertelder wrote: post #4

I'm using Chromium on Ubuntu 16, and I've been trying to visit https://www.nist.gov/ but I don't even get an option to 'browse insecurely' under the 'Advanced' link. In my experience that past couple days, I get the warning on about 10-25% of major web sites.

try typing 'badidea' on that page and report back if it works. :)

Well there's a nice little easter egg, I could have really done with that a week ago while doing a load of provision testing with LE staging certs!

Re: Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate

#29

Post by jlgaddis »

swalsh wrote: post #24
agwa wrote: post #22

Author here. It has gotten kind of hard to follow what has happened, so here's a chronology: 1. In September, Chrome 53 was released, which enabled mandatory Certificate Transparency for Symantec certificates due to Symantec's history of incompetence. Some website operators, such as Chase, asked Symantec to submit their certificates to Certificate Transparency logs in such a way that the certificate wouldn't be trust…

Is there any reason, in 2016, to use Symantec over LetsEncrypt?

I use LetsEncrypt on a (personal) site or two and on a couple for work.

We've got customers that mostly run Windows, however, and it's a helluva lot easier to, for example, just get a three-year certificate from , install it, and then forget about it for the next three years.

Fortunately, I don't (usually) have to deal with the Windows boxes (i.e. actually installing and/or configuring the certificates) but I'm often the one acquiring the certificates.

Re: Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate

#30

Post by joering2 »

Somewhat off-topic but what a horrible bank they are.

A friend of mine's father almost got a heart attack by trying to refinance their underwater house. Despite of being a US veteran and government willing to sponsor their whole mortage through some special aid program, Chase chosen not to accept check from said agency. If that would be check from him they would gladly take it.. but not from gov. Government, of course will not want to write a check for him, so its a catch 22.

They currently file a lawsuit that Chase gladly accepted (thank God my friend has a good lawyer who took it pro-bono), but it just shows you to what extent they will go just to make an extra buck.

Post reply on HN