I am trying to open an internet banking website in Chrome.

Chrome is showing me that the website is insecure:


But if I try using another browser like Safari it shows as secure:


I checked with my friend, and it's working fine on Chrome for them. I have also tried disabling all the extensions in Chrome.

Any ideas what is causing this issue?

Screenshot of the certificate : enter image description here

  • 1
    If you click on the "Not Secure" text it will tell you why they don't believe it is secure. Can you post a screenshot of the explanation? – Michael Frank Apr 5 '18 at 7:01
  • Sounds like you have a Chrome extension that is breaking the internet by using a fake certificate. Verify the certificate being used was issued to the bank and update your question – Ramhound Apr 5 '18 at 7:44
  • @MichaelFrank I have added the screenshot. The same thing is valid in my friend's chrome. – Prajwal Apr 5 '18 at 11:30

The issue is that the banks IPV6 certificate is set up incorrectly, and as its missing an intermediate cert. This problem will only be apparent on (some) IPV6 connections - IPV4 connections don't seem to have this issue.

I ran this through the ssllabs test - note the Certification Paths "Extra download"

(The missing cert is DigiCert SHA2 Extended Validation Server CA Fingerprint SHA256: 403e062a2653059113285baf80a0d4ae422c848c9f78fad01fc94bc5b87fef1a Pin SHA256: RRM1dGqnDFsCJXBTHky16vi1obOlCgFFn/yOhI/y+ho= RSA 2048 bits (e 65537) / SHA256withRSA)

  • Thanks. Is it secure to use this website ? – Prajwal Apr 5 '18 at 11:39
  • Depends on how you define secure. The first thing to do is compare the fingerprint/thumbprint for the cert in your browser properties with one that has a green bar , or to track down the intermediate cert and add it to your browser to ensure no one is performing an MITM attack. This would make it as secure as anyone else's connection..... – davidgo Apr 5 '18 at 18:40
  • That said, their web server allows weak ciphers and does not do perfect forward secrecy on all browsers - that means someone with a LOT of resources and able to intercept the traffic could thepretically capture the data and decrypt it at a later date. That means they may be able to see what you did, and, depending on if the bank uses 2 factor authentication / password changes - could log in and take your money.... – davidgo Apr 5 '18 at 18:45
  • That said, it's still probably a lot safer then other ways of transacting - ie risk of someone stealing/cloning your debit/credit card and pin. The concern is that if I can easily get an A+ grade on SSL test but a bank only gets a B - what does that say about their security practices in general? – davidgo Apr 5 '18 at 18:49

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.