Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Certificate Transparency in Firefox

blog.transparency.dev

Post reply on HN
Print view View original

111–116 of 116 posts

Re: Certificate Transparency in Firefox

#111

Post by cmeacham98 »

tialaramex wrote: post #104
snailmailman wrote: post #80

I have had the flag to enable this setting enabled for quite some time. It’s never caused any issues. I have only seen it pop-up once- for a cert that I had just issued a second prior. The cert was logged properly and the page loaded another second later. Very quick.

> I have only seen it pop-up once- for a cert that I had just issued a second prior. The cert was logged properly and the page loaded another second later. Hmm. Possibly a timing issue? It is conventional to slightly "back date" certificates so that they claim to have been issued an hour ago, as obviously if users forgot to adjust a PC for the clocks changing your site should still work & it was seen as easier to jus…

More likely guess, given a refresh fixed it: there was a slight delay with the CT log and it hadn't started returning the precertificate yet.

Re: Certificate Transparency in Firefox

#112

Post by tialaramex »

cmeacham98 wrote: post #111
tialaramex wrote: post #104

Earlier quoted context omitted.

> I have only seen it pop-up once- for a cert that I had just issued a second prior. The cert was logged properly and the page loaded another second later. Hmm. Possibly a timing issue? It is conventional to slightly "back date" certificates so that they claim to have been issued an hour ago, as obviously if users forgot to adjust a PC for the clocks changing your site should still work & it was seen as easier to jus…

More likely guess, given a refresh fixed it: there was a slight delay with the CT log and it hadn't started returning the precertificate yet.

The browser isn't talking to the CT log, nor to the CA. It's just looking at the documents it was given, typically the certificate for a single intermediate and then the certificate for server itself which has the SCTs baked inside it.

Suppose that you get a cert minted for your new server on 1st March at 14:56:09 UTC, the CA does a few checks, concludes this is OK and writes a to-be-signed certificate dated 1st March 13:56:11 UTC, then it mutates this tbsCert by adding poison (per the CT design) signs that and sends it to two CT logs shortly after, each CT log accepts this poisoned pre-cert and provides an SCT dated 1st March 14:56:15. The CA fastens these SCTs to the tbsCert it made before and signs all of that, which it provides back as a new certificate, this delivery completes at 14:56:21 only 12 seconds after you started and your server can use it immediately.

Unfortunately your PC's clock is 15 seconds slow, it still believes it is 14:56:06 and so when it tries to visit the web site and sees the SCTs with 14:56:15 on them those are from the future and not yet valid. A message is shown explaining that this isn't valid, you take a moment to read it and then try refreshing at what you believe (based on your PC clock) is 14:56:15. This time though it all works because now the documents are valid.

Re: Certificate Transparency in Firefox

#113

Post by tracymiranda »

masfuerte wrote: post #45
braiamp wrote: post #33

I am on Debian Firefox 135.0.1 and https://no-sct.badssl.com/ doesn't error out as expected. Is Debian doing something different?

I do get the warning using the same Firefox version on Windows. Note that the link in the article is mangled. The link text is https://no-sct.badssl.com/ >, but the actual href points to https://certificate.transparency.dev/useragents/ >. Your comment has the correct link which gives the warning.

Thanks for flagging this - I've updated the post to fix the link

Re: Certificate Transparency in Firefox

#114

Post by tracymiranda »

ruuda wrote: post #90

Through this article, a few links away, I learnt about tiling logs, explained in https://research.swtch.com/tlog .

Tiled logs are cool & Chrome are starting to forge a path towards adoption: https://groups.google.com/a/chromium.org/g/ct-policy/c/HBFZH...

Re: Certificate Transparency in Firefox

#115

Post by snailmailman »

tialaramex wrote: post #104
snailmailman wrote: post #80

I have had the flag to enable this setting enabled for quite some time. It’s never caused any issues. I have only seen it pop-up once- for a cert that I had just issued a second prior. The cert was logged properly and the page loaded another second later. Very quick.

> I have only seen it pop-up once- for a cert that I had just issued a second prior. The cert was logged properly and the page loaded another second later. Hmm. Possibly a timing issue? It is conventional to slightly "back date" certificates so that they claim to have been issued an hour ago, as obviously if users forgot to adjust a PC for the clocks changing your site should still work & it was seen as easier to jus…

Oh interesting. I didn’t realize certs get backdated a bit, but that makes a lot of sense. Interesting that the same isn’t done with SCTs.

I doubt my system time was off by 10 seconds, but I have seen it off by nearly a full second quite frequently. (I checked just now, 700ms behind?) I was checking it quite often via time.gov for a while, and I know the inaccuracy returns after each boot. Maybe my bios doesn’t keep milliseconds, leaving me at ~1s precision only. I suppose that’s probably fine most of the time, but I feel like it should be more precise. Depending on how much it drifts it could be drifting further...

In the case I saw this error, the cert did not exist until I requested the page. Caddy then handles cert creation on-demand and serves it immediately. It’s my own local server- so my latency to it is <1ms - there isn't much time for the cert to become-more-valid if its fresh. It seems likely that my PC fell behind the server enough that the cert wasn't valid for a second or more? I'm tempted to investigate, but right now I only have one cert that needs updating - and it seemed to reissue and load the page just now without issue. (But looking at the cert, I see what you mention - the cert got backdated but not the SCT.)

Re: Certificate Transparency in Firefox

#116

Post by snailmailman »

snailmailman wrote: post #115
tialaramex wrote: post #104

Earlier quoted context omitted.

> I have only seen it pop-up once- for a cert that I had just issued a second prior. The cert was logged properly and the page loaded another second later. Hmm. Possibly a timing issue? It is conventional to slightly "back date" certificates so that they claim to have been issued an hour ago, as obviously if users forgot to adjust a PC for the clocks changing your site should still work & it was seen as easier to jus…

Oh interesting. I didn’t realize certs get backdated a bit, but that makes a lot of sense. Interesting that the same isn’t done with SCTs. I doubt my system time was off by 10 seconds, but I have seen it off by nearly a full second quite frequently. (I checked just now, 700ms behind?) I was checking it quite often via time.gov for a while, and I know the inaccuracy returns after each boot. Maybe my bios doesn’t keep…

oh wow! yeah my clock sucks. checked again today - clock is incorrect by 5 entire seconds! its unclear why windows isn't resyncing and correcting it. had to manually click the button to sync time and its fixed again for now.
Post reply on HN