New issue
Advanced search Search tips

Issue 846652 link

Starred by 3 users

Issue metadata

Status: Assigned
Owner:
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 3
Type: Bug
Team-Security-UX



Sign in to add a comment

SSL Certificate Validity not Updating

Reported by shaundav...@gmail.com, May 25 2018

Issue description

UserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.181 Safari/537.36

Steps to reproduce the problem:
1. Load site with insecure SSL Cert
2. Update SSL Cert or wait for new SSL to become active on site.
3. Click the 'Not Secure' warning and it will show there is, in fact, a secure SSL certificate but will still display as insecure in the address bar.

What is the expected behavior?
Address bar updates depending on the status of SSL regardless of cached data.

What went wrong?
The current security status of the site not displayed correctly in the address bar.

Did this work before? N/A 

Chrome version: 66.0.3359.181  Channel: stable
OS Version: 10.0
Flash Version: 

This was seen on a website which had a default *.azurewebsites.com ssl cert when first loaded and a GoDaddy Standard UCC SSL with the domain configured as a SAN alternate domain.
 
Clearing up final comment above, on the second refresh the new SSL cert had been applied which replaced the default *.azurewebsites.com SSL cert
Components: UI>Browser>Omnibox>SecurityIndicators
Labels: -Pri-2 Needs-Feedback Pri-3
Owner: carlosil@chromium.org
Status: Assigned (was: Unconfirmed)
Taking this one for now, I'll try to set up a reproduction case on Monday.

Reporter: On your steps to reproduce, you refreshed between 2 and 3 and the Not Secure indicator did not change? Also, was this after proceeding through the interstitial, or while on the interstitial?
Hello Carlo, that is correct. I refreshed using the refresh button and via ctrl + f5. I could see in the dialog that appeared on clicking not secure that it could see there was a valid SSL cert and I could see it was secure using another browser and on a different machine with the same browser.

Unsure what your second questione means.
Thanks for clearing that up! As for my second question, what I meant was, since this page had an invalid SSL cert, you should have gotten a "Your connection is not private
" warning page the first time you visited, my question was whether you are refreshing (and therefore seeing the error) while seeing the warning page, or after clicking "Proceed to..." 

Thanks again.
Ah ok, apologies. I'd gotten the warning as you expected but continued anyway as I was waiting for the SSL to apply. I refreshed on the page itself.

Comment 7 by afellin@google.com, Jun 10 2018

I can reproduce this on CrOS as well (see attached screenshot). The Not secure chip remains even after reloading the page with ctrl+shift+r. After logging out and back in, the Secure chip shows up.

Steps to reproduce are the same. I clicked through the interstitial (rip badidea), renewed the cert on the server, then refreshed the page. The cert's "Valid" link shows details for the updated cert, not the expired one.
06FfLY5WQR2.png
46.7 KB View Download
Labels: -Needs-Feedback
It looks like the requested feedback was provided; removing the label.

Sign in to add a comment