0

I have this annoying problem - every time I get into a site with a security certificate I always see a warning page that the certificate is invalid. I've grown accustomed to just setting an exception and never seeing this again (for sites I trust of course).

Today I tried browsing godaddy to buy a domain, and it started acting weird - it only shows me a text version of the site, where most of the images and the style page are missing. A screenshot of the top of the page:

enter image description here

Only at the end of the page does some kind of unstyled plain text dump appears. I can only come to the conclusion that the CSS file in unsigned and that Firefox doesn't show it.

My questions:

  1. How come the Firefox thinks that all the certificated it sees are invalid (including it's own, like addons.mozilla.com)?

  2. Why doesn't go daddy work right, and how do I fix it?

Edit: IE7 shows me a page about the certificate not being valid but than shows me the page nicely formatted.

I should maybe add that I'm a pretty security aware guy, and that I don't beleive it's a problem caused by malicious software on my computer. I tried installing a fresh copy of windows on a virtual machine and Firefox showed me the same error.

Further details: The exception text is:

www.godaddy.com uses an invalid security certificate.

The certificate is not trusted because it is self signed.
The certificate expired on 1/25/2009 7:35 PM.

(Error code: sec_error_expired_issuer_certificate)

I'm pretty sure my computer time is right (21 august 2009, unless I'm insane too, but that's a different question :))

4
  • 1
    does it work in another browser?
    – DrJekl
    Aug 21, 2009 at 13:59
  • So, you're having the same certificate problem in Internet Explorer (though it renders better). Please change the title to make sure people understand that.
    – Arjan
    Aug 22, 2009 at 7:11
  • No - the site looks malformed only with Firefox, IE shows it ok.
    – Mikle
    Aug 22, 2009 at 13:09
  • Still, you have the certificate problem in both Firefox and IE, and that is the cause of the rendering problem. Right? Your problem is the certificates (or whatever malware is running on your computer, or odd network settings, that causes the original GoDaddy certificate as shown by theotherreceive to NOT be used).
    – Arjan
    Aug 26, 2009 at 17:13

4 Answers 4

5

No No No No. Do not set exceptions, they are ment to be exceptions not the norm. If you are constantly seeing it then you are likely the victim of a man in the middle (http://en.wikipedia.org/wiki/Man-in-the-middle_attack) attack.

By allowing exceptions you are completely forfeiting one of the protections afforded by the certificate - trust. Companies (ecommerce, banks etc) pay a lot of money to people like Verisign to get a certificate that they counter sign. This allows you to trust the certificate is :

a) Valid
b) Not tampered with
c) Trustable

The only time you should ever trust an unsigned certificate is a self signed one you have created yourself. ANY other kind should be treated with the greatest suspicion.

I would strongly suggest you reinstall your operating system, something is not right and if you have been infected with spyware / malware or rootkitted then the only way to reverse it is to start from a clean slate.

5
  • I just powered up a brand new VM, installed windows on it from the same disk I used to install mine downloaded Firefox and went to Godaddy.com to do the same shtick. It showed me the same error, so we can rule out a Rootkit. What other stuff may cause that?
    – Mikle
    Aug 21, 2009 at 15:12
  • I need to set an exception to be able to access my schools email servers...
    – KdgDev
    Aug 21, 2009 at 15:17
  • That doesn't necessarily mean a thing, if you're using NAT it would be using the network settings of the host pc and be susceptible to any issues on the host.
    – Col
    Aug 21, 2009 at 15:19
  • I agree with Col, a VM having the same issue means the problem is between your machine and the Internet. Check your router, LAN and WAN.
    – Konrad
    Aug 21, 2009 at 15:56
  • Col, can you elaborate in an answer? I am behind a router (so I am behind a NAT too) and it may be configured wrong.
    – Mikle
    Aug 21, 2009 at 16:04
0

It would help to know what kind of invalid error is occuring. For example:

  • Is it expired/not yet valid - then your computer may not be set to the correct time
  • Is is not signed properly - then you're being offered a bad certificate -- quite possibly a man in the middle attack
  • Is it from an untrusted CA or self-signed? Then it might be OK to add it to your trusted certificate list, if you recognize and trust the CA signing the certificate. I find self-signed certificates a little dodgy, and don't add them to my cert store, unless i know I'm looking at a known test website.
  • Does the domain of the certificate match the domain presented - if not, don't trust it. If you need to use the site, call the site provider and get their help figuring out what's wrong.

I'm assuming you don't have any add-ons that do validity checks to OSCP or CRLs... that's a heavy duty security thing that most normal people don't use. If you do have a client for OCSP checking, let me know which one and what it's results say.

When I hit GoDaddy with my own firefox, I don't get an error, I do get to GoDaddy's certificate, which is signed by their CD (Go Daddy Secure Certification Authority) which my browser trusts.

If you throw up the SHA1 or MD5 hash of the certificate, I will gladly cross check with what I see here:

  • click "GoDaddy.com, Inc (US)" next to the URL.
  • click "More Information"
  • click "View Certificate"
  • take a picture of the window (On Windows this is alt-print screen) and post somewhere public and reference URL.
6
  • Added, sorry but I can't link so many stuff since my reputation from SO didn't transfer and new users can't post more than 1 link (wtf?)
    – Mikle
    Aug 21, 2009 at 15:56
  • imgur.com/K69tf.png Is it right? (taken from the VM).
    – Mikle
    Aug 21, 2009 at 16:18
  • I will check when I get home. My work isn't letting me get to URL (grumble... unmentionable words... grumble...) Aug 21, 2009 at 20:52
  • I checked with a friend and it seems different. What can cause such a thing? Maybe the ISP? Router? Argh...
    – Mikle
    Aug 21, 2009 at 21:12
  • Sounds funky. Either they have multiple servers, each with a different cert (but they should all be signed by the same CA provier), or you are actually hitting something that isn't GoDaddy. Aug 24, 2009 at 18:46
0

It would help to know the specific failure of the ssl certificate, however in my experience, the most likely cause is your system time/date, as you said you had the same problem in a VM.

FYI - The reason about formatting is because if you have a certificate error in IE and accept, it renders the whole page from all sources where as in Firefox, as many sites have content from different domains, you need to accept the ssl from those sites as well.

You can do view source then look for https://whatever and type that in to the address bar and then allow it through - however do not permanently store exceptions unless you really trust the site.

2
  • I can, but than wouldn't it be easier and saner to just use IE?
    – Mikle
    Aug 21, 2009 at 15:57
  • yes, I was just explaining why it was happening! Aug 21, 2009 at 16:00
0

Is there some sort of proxy you're going through on your network? It sounds like you could be seeing cached data. My first thought was a virus/rootkit as well, but the VM test rules that out (unless the VM was running on the same machine)

The GoDaddy thing is especially odd, since I can verify that the cert is neither self signed nor expired.

alt text

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .