Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

In the HTTPS/SSL section of chrome://chrome/settings, I see the following: Certificate Manager What does this mean, and is there something wrong?

I have a basic understanding of SSL/TLS - I'm not claiming to be completely familiar, but I'm fairly confident I know my way around it - but I don't understand why I have certificates installed on my machine specifically for these sites.

From my understanding, I should have the certificates for Certificate Authorities, and any site I visit and use SSL/TLS should have a certificate signed by one of these trusted CAs for me to trust the site.

My worry is that if someone has maliciously installed a certificate for these sites on my machine, they could perform a DNS spoofing attack (or a number of other attacks) to hijack my connection to my email account without me knowing, and as they've got the private counterpart to the certificate on my machine, decrypt the communication.

NB: I'm also aware that CA certificates aren't just within Chromium and are used system wide as part of libssl - they're stored in /etc/ssl/certs.

What I'd like to know is:

  • Is this correct? - The big red boxes make me think no
  • Is this malicious or benign?
  • What can I do to resolve this problem? (If indeed it is a problem)

Thanks :)

share|improve this question
    
If you check the CA for each cert, you can check in the Authorities tab to see if you have matching CA cert. Addons.mozilla.org should be Verisign, it is weird how it is listed under Google Ltd –  Paul Nov 19 '12 at 2:41
    
What is your clock set at? –  Canadian Luke Nov 19 '12 at 2:42

1 Answer 1

up vote 3 down vote accepted

This is a good thing. Those certificates were revoked, often because someone applied for/acquired a certificate (private key) for an entity they don't own, which can be used for impersonation. The revoked certificate list on your system basically tells your system not to trust these certificates.

Certificates are often used to identify the website, which relies on the issuer not issuing it to someone else. Those certificates in your screenshot were listed as fraudulent or untrusted because the issuer made a mistake and must tell everyone not to trust the certificate they already signed. Occasionally, the group that created the trusted list (e.g. your OS/browser developers) may manually add certificates to the untrusted list, possibly if the issuer takes too long to do so.

See for more info: Public key certificate and Revocation lists

enter image description here

enter image description here

enter image description here

share|improve this answer
    
Thanks! I've heard of revocation lists and expiry before but I guess I didn't put 2+2 together :) –  jackweirdy Nov 19 '12 at 13:08
    
@jackweirdy You also appear to be looking at the servers list, which would only list server specific certificates - i.e. those you manually add as (un)trusted, or those on a CRL. The authorities list (in the other tab) probably lists root and intermediate CAs. Most sites would use a certificate from a common CA, rather than requiring users to manually add a certificate to their trusted list. I'm not sure about Chrome, but when a certificate cannot be validated in FF I have the option of temporarily accepting it or permanently adding an 'exception', which means adding it to a trusted list. –  Bob Nov 19 '12 at 13:15
    
I understood the concept of CAs; I was just surprised to see entries for specific servers :) Chrome & Chromium warn you that the certificate is invalid/self signed and let you decide what to do :) –  jackweirdy Nov 19 '12 at 17:54

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.