4

OS X Mavericks 10.9.2 / Chrome 33.0... / Safari 7.0.2

I am unable to log in to StackOverflow using Chrome or Safari. Clicking the "log in" link displays a login page UN-styled by CSS and where the "Login" button does not respond to mouse clicks. I am, however able to log in using FireFox, which I am using to post this question.

In Chrome I tried disabling all Extensions, but the faulty page display persisted.

Any thoughts?

Edit with Additional Information:

Opening the Developer Consoles while on the Login page [https://stackoverflow.com/users/login] in both Chrome and Safari, I am seeing certificate issues for cdn.sstatic.net resources:

  • Failed to load resource: net::ERR_INSECURE_RESPONSE (in Chrome)
  • Failed to load resource: The certificate for this server is invalid. You might be... (in Safari)

While I am able to reach cdn.sstatic.net in all browsers via http, I am blocked in Safari/Chrome when I try to access it via https:

  • The site's security certificate is not trusted! and
  • Safari can't verify the identify of the website "cdn.sstatic.net"

Safari show me that the certificate ("ssl4121.cloudflare.com") is for cloudflare.com whereas the link is for sstatic.net, thus throwing the error.

My Interim Solution

  • Visit https://cdn.sstatic.net in Safari/Chrome
  • Click "Proceed anyway" in Chrome
  • Click "Show Certificate" in Safari, then select "Always Trust" in the "Trust: When using this certificate" dropdown.

Now, visiting the login page correctly displays the correct CSS and allows me to Log In (finally).

Feels like a bit of a hack, but it worked.

Certificate: Unknown Authority

I removed the certificate ("ssl4121.cloudflare.com") from my Keychain in Keychain Access in order to re-test this issue. The results were the same, with an unstyled and unusable Login page.

After I re-imported the certificate into Keychain Access, the message "This certificate was signed by an unknown authority" is displayed in red near the top. When I mark it again as "Trusted", that message disappears.

Improve this question
20
  • 1
    Apparently, the static domain is blocked.
    – bjb568
    Mar 29, 2014 at 5:54
  • Weird, my Safari (and other browsers, all latest version, on latest OS X) have no trouble with that certificate. It defines a Subject Alternative Name extension, which includes *.sstatic.net. Your Mavericks seems up to date as well. As for "Safari show me that the certificate ("ssl4121.cloudflare.com") is for cloudflare.com whereas the link is for sstatic.net, thus throwing the error": is it really saying that the different name is the cause? Or is that your own conclusion and do we need to investigate other options (such as missing root certificates)?
    – Arjan
    Mar 30, 2014 at 21:13
  • That was my own, perhaps simplistic, conclusion.
    – W L Bentley
    Mar 30, 2014 at 21:45
  • (In case you don't: see Replying in comments.)
    – Arjan
    Mar 31, 2014 at 19:27
  • Then can you double-click the HTTPS icon in the browser's address bar for cdn.sstatic.net/stackoverflow/all.css, and scroll to see if there's any error message? See also the certificate in my Safari: Part 1, 2, 3, 4.
    – Arjan
    Mar 31, 2014 at 19:48
  • Also, click the "parent" certificates in that dialog. And make sure your clock (date, year) is correct?
    – Arjan
    Mar 31, 2014 at 20:07
  • Ah, I missed your earlier edit of the question. Which issuer is not trusted? The GlobalSign Root CA, or the intermediate GlobalSign Organization Validation? And did you install all Mavericks updates?
    – Arjan
    Apr 1, 2014 at 5:18
  • @Arjan Ah, it's GlobalSign Root CA that's not trusted. See here. And yes, I've installed all Mavericks updates and my clock is correct.
    – W L Bentley
    Apr 1, 2014 at 16:43
  • @Arjan First, I removed the trusted certificate from Keychain. Then, from Chrome, here are the messages and certificate information I got by double clicking the HTTPS icon for "all.css": 1 2 3 4 5 6
    – W L Bentley
    Apr 1, 2014 at 16:51
  • Just to be sure: you only removed the trusted Cloudfare certificate, right? I find it odd that the error for GlobalSign says (emphasis mine): This certificate is marked as not not trusted for all users. I wonder if that means it has somehow been explicitly marked as such. Guess you'll never find out. To compare: I've got quite a few GlobalSign certificates in Keychain. In case you want to compare hashes before you maker the root as trusted: my part 1 and 2.
    – Arjan
    Apr 1, 2014 at 17:36
  • Ah, Keychain's preferences shows an option in General: "Reset My Default Keychain - Reverts to factory defaults and creates a new empty "login" keychain. Your current default keychain will be moved aside, but not deleted." Also, in Certificates, I have - "Online Certificate Status Protocol (OCSP)" and "Certificate Revocation List (CRL)" both set to "Best attempt", and "Priority" to "OCSP". (I've not changed anything there, I think.)
    – Arjan
    Apr 1, 2014 at 17:40
  • (Hmmm, one "not" too many in my previous comment, but too late to edit. Just for SEO: This certificate is marked as not trusted for all users.)
    – Arjan
    Apr 1, 2014 at 17:44
  • @Arjan Yes, I only removed the CloudFlare certificate. And my Keychain settings are the same as yours.
    – W L Bentley
    Apr 1, 2014 at 18:06
  • @Arjan I have several GlobalSign certificates, and all but two are marked as untrusted. Also, they seem to be untrusted only on my laptop, and not on my office desktop. I have a very vague memory of some GlobalSign certificates being suspect a couple years ago, so they may have all been explicitly marked as untrusted then, without understanding all the consequences. I guess now I have to find a way to back out of that situation. I'll try comparing my hashes to yours. And perhaps see if starting over with a new keychain is feasible.
    – W L Bentley
    Apr 1, 2014 at 18:07
  • 2
    @Albioner if you have removed the certificate issuer, then this sounds self-inflicted...
    – Marc Gravell
    Apr 1, 2014 at 19:28

1 Answer 1

Reset to default
3

SSL/TLS security works by certificate chains. On any domain we support TLS on, we serve a certificate. That certificate was issued by someone - in the case of cdn.sstatic.net it was issues by GlobalSign. For the sites directly it's currently DigiCert (Stack Exchange vs. CloudFlare getting the cert). That certificate tells who issued the cert, whether it be a certificate authority or an intermediate.

That's how trust works, you trust the certificates all the way up the chain until you get to one you know and trust. Your browser or machine has a list of CAs that you trust, so when a certificate chain connects to those, you know you've established a chain of trust, and therefore trust our certificate.

If you mark one of those CAs as untrusted you no longer trust us and the browser appropriately blocks the content, since it's from an untrusted source. What happens if you do that? Things will break, which is what happened here.

Bottom Line: Don't do that

Be aware that marking a well known certificate authority as untrusted will have consequences across the internet.

Improve this answer
1
  • 2
    Right. There was in fact a GlobalSign breach in 2011, and recommendations were made, valid or not, to not trust GS certificates at the time. This is the likely source of the problem. Another learning experience. Thanks for all the help.
    – W L Bentley
    Apr 1, 2014 at 19:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .