3

When accessing US military websites from a commercial computer and web browser you will sometimes run into an incompatible security configuration.

Two examples are:

Why does this happen?

1
  • 2
    Sorry for not taking the time to write up an answer. If someone else wants to explain in more detail, they're welcome to. i.stack.imgur.com/d2RrS.png
    – 3D1T0R
    Dec 22, 2018 at 0:05

1 Answer 1

6

The SSL/TLS certificates for those websites were issued by the Department of Defense (DOD) certificate authority (CA). Commercial browsers like Chrome and Firefox build in trust for various CAs, essentially creating a list of trusted certificate issuers. This will include established entities that provide commercial certificates like Comodo, DigiCert, and GlobalSign.

However, most commercial browsers do not include the DOD CA in this list. Since it's not in the list of "trustworthy" CAs, the browser raises a security warning whenever it encounters a certificate issued by the DOD CA. That's likely what you are seeing with these two examples; if you open the details of the warning it will say something like ERR_CERT_AUTHORITY_INVALID.

Operating systems can also include CAs as trusted issuers. Military computers have the DOD CA in the trusted list and don't see this warning.

Not the answer you're looking for? Browse other questions tagged .