Issue metadata
Sign in to add a comment
|
Developer Tools Security tab still shows the main origin as secure even if its intermediate issuer certificate is signed using SHA-1
Reported by
93m4qau...@gmail.com,
Mar 14 2018
|
||||||||||||||||||||||||||
Issue descriptionUserAgent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3370.0 Safari/537.36 Steps to reproduce the problem: 1. Open https://sha1-intermediate.badssl.com. 2. Press Ctrl+Shift+I to open Developer Tools. 3. Click on the Security tab. 4. Press Ctrl+R to reload the page (while keeping Developer Tools open). 5. Look under "Main origin". What is the expected behavior? Since the certificate chain for the site contains a certificate signed using SHA-1, the main origin ("https://sha1-intermediate.badssl.com") is considered insecure. What went wrong? Even though the certificate chain for the site contains a certificate signed using SHA-1 - downgrading the security status in the omnibox and in the "Security overview" in Developer Tools - the main origin is still considered secure. Did this work before? N/A Chrome version: 67.0.3370.0 Channel: canary OS Version: 6.1 (Windows 7, Windows Server 2008 R2) Flash Version:
,
Mar 19 2018
Thanks for filing the issue! Able to reproduce the issue on reported chrome version 67.0.3370.0 using Windows 7 and latest canary 67.0.3375.0. Note: Issue is not seen on Windows 10 and Ubuntu 14.04. Unable to check the same on Mac 10.13.1 as our network isn't allowing us to navigate to the given URL. The issue is seen from M60(60.0.3080.0) hence considering it as Non-Regression and marking it as Untriaged. Attaching the screenshot from M60 for reference.
,
Apr 2 2018
Could elawrence@ or estark@ please take a look?
,
Apr 2 2018
I believe this is working as expected due to a compatibility accommodation for Windows 7 pathbuilding. I can try and find the duplicate bug shortly.
,
Apr 3 2018
This is expected behavior on Windows 7 only. Windows 7 does not provide sufficient control over how the chain is built, meaning that it may build a chain through a SHA-1 intermediate when a SHA-256 intermediate is also available.
,
Apr 5 2018
Why is that bug view restricted? Is there sensitive security content in it, or is it just Google Chromium paranoia?
,
Apr 6 2018
Okay, an unrestricted duplicate is here: https://bugs.chromium.org/p/chromium/issues/detail?id=588789#c35 |
|||||||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||||||
Comment 1 by viswa.karala@chromium.org
, Mar 15 2018