Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Cert-patrol warns me on numerous websites, including gmail, that the certificate being used wasn't due yet. Is this something I need to worry about? Why does this occur?

Here is a screen-shot (you probably need to zoom in to read it):

enter image description here

If I click on the details, it shows something which to me looks like the certificate should be valid since today is Aug 17, 2012, and it says that the (new?) certificate was issued 22 days ago. Is it because the old one hasn't expired before? Why does Google then use a new one? Do companies frequently do this?

enter image description here

Update: Here are the certificates: enter image description here and enter image description here

share|improve this question
    
might sound silly, also check your computer's date, in case the extension uses system date.. –  tumchaaditya Aug 27 '12 at 11:21

2 Answers 2

up vote 0 down vote accepted

Please also post the full details/view of both old and new certificates.

But unless some date is wrong somewhere in these certificates (really unlikely with Google), or that there was an overlap between both certificates (old terminating after start-date of new), I would say that this is a bug in CertPatrol with too-new certificates.

You might try using the CertPatrol webchat to ask about this problem.

[EDIT]

Examining the two posted certificates, I can see that both certificates are valid for now. The difference between the two is that one is issued to *.google.com (google itself) and the other to *.googleadservices.com (google advertising). Both were issued by the same authority (CA).

Google is therefore mixing content on the page from two domains, each domain having its own certificate. This is exactly what CertPatrol is supposed to warn about, although the message text you see is incorrect and misleading. I quote from their website :

Several websites have the bad habit of using multiple certificates for the same hostname. We consider it a configuration error on their side, but since they insist, you now have a little option of the certificate change pop-up to accept any certificate for that host as long as the issuer, that is the next higher level authority, stays the same.

The above shows that in the case of multiple certificates you will get a pop-up. Which is exactly what is happening.

I would suggest that you accept both certificates without any worry.

You could signal this problem with the wording of this dialog to the developers via CertPatrol webchat.

share|improve this answer
1  
The link says Firefox can't establish a connection to the server at psyced.org:33333. –  highBandWidth Aug 21 '12 at 18:34
    
Try later, since it worked for me right now. –  harrymc Aug 22 '12 at 5:39

Harrymc's answer is sorta correct, but this has nothing to do with the fact that you posted certs for two different domains in your update or that the page contains content from different domains. The CertPatrol image that you posted initially shows that the error is from two different certs on the same domain.

The root cause of this problem come from the fact that when you go to Google, you're not always connecting to the same server. The problem here arises from the fact that Google seems to use different certs on it's different physical servers.

I can only speculate as to the reason that they do this, however I have to imagine they do this in case a sever gets hacked into and a cert gets stolen they would only need to revoke that one server's cert and take it down with out affecting the rest of their servers.

The only way to work around this problem is to tell CertPatrol to allow any cert for that domain. This issue is the main reason that I stopped using cert patrol a few months ago.

share|improve this answer
    
You are correct about the lack of homogeneity of servers on the Google network, but servers do not switch domains. The domains google.com and googleadservices.com are too distinct. –  harrymc Aug 23 '12 at 18:14
    
I'm not 100% sure what you mean, but I'm not saying that the two domains are somehow the same. I'm saying that you shouldn't be looking at the certs from two different domains. If you look at the first image you'll see that the two certs that are being compared are both from *.googleusercontent.com. Edit: Also, the two certs that were posted in the update have nothing to do with the first pair of certs. –  Azdle Aug 23 '12 at 21:33

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.