Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I think Chrome only shows the red sign in the address bar, not the usual warning page.

This step was announced some time ago, and since certificates usually need to be replaced frequently, there should be very few problematic certificates, if the CAs did their job.



> This step was announced some time ago, and since certificates usually need to be replaced frequently

Most people will buy certs valid for a few years, or around a couple of dozen Chrome-releases, and forget about them until they expire.

From my experience, among the things deployed in the world of IT, I would argue they are among the things replaced most infrequently.

So I'm curious... What makes you say certificates needs to be replaced frequently? What's the use-cases you are referring to?


Yeah, *.ycombinator.com is using a 5-year certificate which was issued in 2014.


That being said. How can I check our cert? The current cert predates my employment with the county and this is something I have never had to deal with.


This is a quick check site I've used previously: https://shaaaaaaaaaaaaa.com/

However the proper test should be done using https://www.ssllabs.com/ssltest/


If you view your website in chrome, you can click on the lock icon in the address bar. Go to the connection tab -> Click certificate information -> Details Tab. You should see one of the entries should be signature algorithm. SHA-1 is a problem. SHA-224 or higher means the cert is on SHA-2 which is okay.


If you are in Firefox, you can also click the padlock icon, and click on the more information button.


It looks pretty bad and alarming. I'm on canary, so I've seen the warning on my own site. With only a weeks warning I have to get this solved before normal customers start seeing it. A big nasty red strike through our reputation.

> there should be very few problematic certificates, if the CAs did their job.

The cert was bought through Network Solutions in the past year. They are not exactly amateurs.

I've already had to spend 45 minutes researching and trying to solve this and I still have to waste more time resolving this.


Yes, that's correct. Due to a subtle bug (https://crbug.com/472978), my beta-channel Chromebook thinks my personal website has a SHA-1 intermediate, so I've seen this happen. There's no certificate warning / interstitial, just the red slash through the "https".


It is still bad. Most users don't understand the difference. And the "in for a penny, in for a pound" mentality is more common than one would hope.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: