New issue
Advanced search Search tips

Issue 666649 link

Starred by 2 users
Status: WontFix
Owner: ----
Closed: Nov 2016
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 2
Type: Bug



Sign in to add a comment

Canary displaying NET::ERR_CERT_WEAK_SIGNATURE_ALGORITHM on Adobe website.

Reported by hlvehe...@gmail.com, Nov 18 2016 
UserAgent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.1 Safari/537.36

Steps to reproduce the problem:
1. Browse to https://get.adobe.com/
2. Verify page displays 'Privacy Error', and details NET::ERR_CERT_WEAK_SIGNATURE_ALGORITHM
3. Verify the page renders without any error/issue in Live/Beta channels of Chrome.

- I verified this on two PC's.
- I don't believe it to be a virus/something malicious as the DNS resolves as expected to 193.104.215.66.

What is the expected behavior?
Shouldn't be receiving this error. Is it at all possible that the certificate got cached or corrupted during a Canary update? Or should they be two separate things?

What went wrong?
"Your connection is not private

Attackers might be trying to steal your information from get.adobe.com (for example, passwords, messages, or credit cards). NET::ERR_CERT_WEAK_SIGNATURE_ALGORITHM"

Did this work before? Yes Unsure, though I believe this was introduced within the last 3 builds.

Chrome version: 56.0.2924.1  Channel: canary
OS Version: 10.0
Flash Version: Shockwave Flash 23.0 r0
Certificate.txt
5.9 KB View Download

Comment 1 by elawrence@chromium.org, Nov 18 2016

Components: Internals>Network>SSL
Labels: -Type-Bug-Security -Restrict-View-SecurityTeam Type-Bug
Status: Available (was: Unconfirmed)
Site loads in M55 and is blocked in M56. I think this is Working as Intended.

The target site is using a SHA-1 certificate that expires the last second of 2016. https://www.ssllabs.com/ssltest/analyze.html?d=get.adobe.com&latest

https://security.googleblog.com/2016/11/sha-1-certificates-in-chrome.html

Comment 2 by hlvehe...@gmail.com, Nov 18 2016 

Beta/Live both don't error out when browsing to the URL... that's why this seemed *odd*.

Comment 3 by mmenke@chromium.org, Nov 18 2016

Components: -Internals>Network>SSL Internals>Network>Certificate
M56 won't go to stable until 2017, at which point, all SHA-1 requests will be rejected by default, so suspect this may be intended (i.e., the expiration date checks that bypass SHA-1 reject-by-default logic have presumably been removed).

Comment 4 by rsleevi@chromium.org, Nov 19 2016

Status: WontFix (was: Available)
Correct. This is WontFix/WorkingAsIntended. Similar to Microsoft and Mozilla, we are rolling out the disabling through the existing channels (e.g. Chrome Canary -> Dev -> Beta -> Stable, Mozilla Nightly -> Aurora -> etc, Windows "Fast" Channel).
►

Sign in to add a comment