New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 662587 link

Starred by 9 users

Issue metadata

Status: WontFix
Owner:
Last visit > 30 days ago
Closed: Dec 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 3
Type: Bug



Sign in to add a comment

User reports show Google sites "This site uses a weak security configuration (SHA-1 signatures)"

Project Member Reported by melodychu@chromium.org, Nov 4 2016

Issue description

There's been reports in our social channel that Google.com and other Google sites are showing this error:

This site uses a weak security configuration (SHA-1 signatures), so your connection may not be private.

Version: M54+
OS: Windows

What steps will reproduce the problem?
I am not able to reproduce....

Threads:
https://productforums.google.com/forum/#!topic/chrome/wPLIGL0Bamk
https://productforums.google.com/forum/#!topic/chrome/PwyLjPMKyLE
 
Cc: rsleevi@chromium.org
Components: -Internals>Network>SSL Internals>Network>Certificate
Labels: Needs-Feedback
Owner: melodychu@chromium.org
Melody: Can you perform outreach to determine
1) Are these only Windows users
2) Are they running Windows 7
3) Have they ensured their Windows is up to date?

If 1 & 2 are true, it's likely a duplicate of Issue 588789
This is a report that is tagged with Windows 10:

https://productforums.google.com/forum/#!topic/chrome/JwqtwATDAFI
(have followed up to confirm)

And and here's one from an Ubuntu user:
https://productforums.google.com/d/msg/chrome/O_QaFFi_rgY/1SXm2OTBBwAJ


Comment 4 by bueroacc...@web.de, Nov 10 2016

Hi there,

its Windows 10, latest Update. 
Chrome see pic. Update shows not possible....

Think your Chain Cert is the problem. It is only SHA1 and only valid to 01.01.2017....

2016-11-10_21h26_29.png
80.1 KB View Download
2016-11-10_21h52_10.png
14.4 KB View Download
Can you attach a chrome://net-internals log (see https://dev.chromium.org/for-testers/providing-network-details ) to Issue 588789? Thank you
Oh, and trying Chrome Canary - https://www.google.com/chrome/browser/canary.html - or Chrome 55 should resolve the issue.

Comment 7 by bueroacc...@web.de, Nov 10 2016

I got in the same browser only a few tabs later,

these two pics. The Chain-Cert has changed....
I got one with end 01.01.2017. In a second tab i got one with 01.01.2018....
The 01.01.2017 is definitly SHA1....

Think that causes the problems. And the question, where did the different cert come from...
2016-11-10_22h02_46.png
20.5 KB View Download
2016-11-10_22h03_25.png
23.2 KB View Download
I appreciate the help, but could you please comment on Issue 588789 with a chrome://net-internals log? That would be far more helpful than the screenshots :)

Comment 9 by bueroacc...@web.de, Nov 10 2016

I am sorry. I have absolutely no experience with that. And i don`t know what i exactly should do. And what data all the logs contain... Still have to read the docs on that....
@bueroa...: Are there problems with the instructions @ https://sites.google.com/a/chromium.org/dev/for-testers/providing-network-details ?  If so, I'd be interested in improving the page.


ping bueroa@, please use the link in #10 for instructions on how to log your error.
I too had this problem with this weak SHA-1 certificate.This affected all services that are from google, like google, gmail and youtube. I uninstalled chrome serveral and also deleted the files related to chrome in the $appdata folders, just  to be sure everything was gone. Reinstalling it, didnt solve the issue. Also resetting the browser did not fix it. I opened up firefox and the certificate there was working just fine.

I download Chrome from the dutch server (chrome.google.com) I thought it might be possible that it has to do with this server. Therefore i decided to download chrome from another location. i went to ninite.com and installed chrome via their installer. (it grabs chrome from the US servers).

After installing Chrome that way, the problem was gone! Before all that i exported the certificate to my desktop, so i will add it here to be reviewed by google.

greetings, Mike
google-certificate.cer
1.8 KB Download
google-certificate2.cer
1.8 KB Download

Comment 13 Deleted

Closing due to lack of response (specifically the net-internals log requested in c#10 & c#11).

Status: WontFix (was: Untriaged)
I deleted my comment #13 because the problem seemed fixed, and then today it reappeared. However, my son did some research, and it's the Google Internet Authority G2 certificate that has a SHA-1 signature. It expires on Dec. 31, 2016, so until Jan. 1, 2017, I'm ignoring the error message. If it's still happening after that, I'll rerun a net-internals log.

Sign in to add a comment