Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

A few days ago, I noticed some issue with my internet connection. Some pages weren't loading all the way, and some connections needed to be restarted several times before they would resolve. I assumed that my connections were just being dropped due to a particularly busy load on my ISP's end (I use Comcast). Today, I started up Chrome, and I saw this message:

The server's security certificate is revoked! You attempted to reach www.google.com, but the certificate that the server presented has been revoked by its issuer. This means that the security credentials the server presented absolutely should not be trusted. You may be communicating with an attacker. You cannot proceed because the website operator has requested heightened security for this domain.

Thinking it could be an extension messing it up, I uninstalled Chrome and tried using Chromium instead, with the same result. This was very worrying for me, so I started some other computers at my house, and was able to replicate the issue (but not at the same time; each one displayed the message at one point but when one displayed it, the others didn't) on them, so I know it's not malware on my end.

None of the other browsers which I tried (Opera, Firefox, and IE) had this issue, but they all seemed to drop a lot of connections. Is there anything I can do to fix this, or is is solely an ISP problem?

Here are some screenshots I put together in Photoshop showing the problem in detail:

share|improve this question
    
Could you open the certificate information for www.google.com (under lock icon → Connection) and post it in your question? –  grawity Sep 29 '13 at 22:52
    
Sure! There's a picture of the default tab. Let me know if you need to see the information in the "Details" tab. –  Reubend Sep 30 '13 at 4:23
    
The general information tab looks different from what I see when I open www.google.com. Can you please post a screenshot of the tabs details and certification path? I see the certificate serial number 50 c7 1e 48 bc c5 06 76, RSA 2048 bits, fingerprint 00 7d 17 eb a4 a3 46 4c 1b 5a 81 c6 47 c0 1c 17 c0 6a ae 40, key id 4a dd 06 16 1b bc f6 68 b5 76 f5 81 b6 bb 62 1a ba 5a 81 2f. –  Werner Henze Sep 30 '13 at 15:02
    
I edited in a Photoshop composition of all the the screens put together. As you can see, the information for the certificate I'm getting is quite different from yours. The RSA key isn't even the same number of bits! –  Reubend Oct 1 '13 at 1:43
    
@Reubend: I can't read anything on your photoshoped image, it's too small. –  Werner Henze Oct 1 '13 at 9:36

2 Answers 2

up vote 1 down vote accepted

There is a type of malware that causes this issue. Reportedly it uses a key that starts with 30 .. .. 00 cb 35 ba dd. I can't read your screenshot to see if that's what you're getting, but it certainly seems worth checking. Your rationale for concluding that it's not malware doesn't really seem logical. Conversely, it could also be your security software.

share|improve this answer
    
My initial rationale involved the fact that both a Windows computer and Mac in my house both showed this message, so I assumed it wasn't a virus. However, I just checked the RSA key I'm getting against the one you posted, and it is the same. So it looks like it is malware afterall. –  Reubend Oct 2 '13 at 19:49
    
If anyone's interested, here's the RSA public key: 30 81 89 02 81 81 00 cb 35 ba dd ef fb 42 3b e9 ca 5e 20 45 52 1c bb 4b d9 dc 3f 14 50 a5 1f 78 db ae 1d 73 47 99 9b 64 54 9f 26 24 df 3d e7 d6 47 e0 5a 26 60 21 d5 e7 a8 71 ec 01 2e e6 18 7a c6 9d 8f ea 30 d5 9c 32 43 b4 a4 0b 87 f4 ba d0 ab 12 52 11 50 46 42 59 25 57 0f 68 fe 83 e7 cd f2 f2 71 bf c9 67 96 84 49 7f 22 b9 bb 8f 29 b5 6f fa 5b 7e e1 c4 4f 4e 73 54 4d 5d 07 e5 fd 09 5a 14 3b e9 5c ca c7 02 03 01 00 01 –  Reubend Oct 2 '13 at 19:51
    
I just ran MSE and it found several things which were apparently the Sirfef trojan. It got rid of them, and google.com now loads with the correct certificate. Thank you so much! –  Reubend Oct 2 '13 at 20:13

please check your system time may be it was wrong(your cmos battery gone ) or the time was not synchronized correctly if you set your time and date correctly it will open

share|improve this answer
1  
The browser says this certificate is revoked. How should this be time related? –  Werner Henze Sep 30 '13 at 15:03
    
As I said in the original post, the issue occurred on multiple computers on my network, so this couldn't be an issue with my main computer's CMOS battery. Just to check, I synchronized my computer's time with the Windows Time server, and the problem persists. –  Reubend Oct 1 '13 at 1:21
    
Ramana's comment relates to the usual cause of the problem; if your time is off, the certificate may appear expired. However, since it's on multiple systems, I would then suspect your antivirus software. I would also suggest checking IE but being sure to enable the option, on the Advanced tab in tools>options, to check for publisher's certificate revocation, and see if you get the same issue. –  Debra Oct 1 '13 at 6:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.