Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.networking > #4065 > unrolled thread

What do do? (forums.mtbr.com uses an invalid security certificate)

Back to article view | Back to comp.os.linux.networking

Contents

  What do do? (forums.mtbr.com uses an invalid security certificate) harry newton <harry@is.invalid> - 2017-06-08 02:29 +0000
    Re: What do do? (forums.mtbr.com uses an invalid security certificate) Dan Purgert <dan@djph.net> - 2017-06-08 10:08 +0000
      Re: What do do? (forums.mtbr.com uses an invalid security certificate) Richard Kettlewell <invalid@invalid.invalid> - 2017-06-08 11:17 +0100
        Re: What do do? (forums.mtbr.com uses an invalid security certificate) Dan Purgert <dan@djph.net> - 2017-06-08 10:34 +0000
      Re: What do do? (forums.mtbr.com uses an invalid security certificate) William Unruh <unruh@invalid.ca> - 2017-06-08 17:20 +0000
        Re: What do do? (forums.mtbr.com uses an invalid security certificate) Jorgen Grahn <grahn+nntp@snipabacken.se> - 2017-06-09 05:51 +0000
          Re: What do do? (forums.mtbr.com uses an invalid security certificate) Richard Kettlewell <invalid@invalid.invalid> - 2017-06-09 10:02 +0100
    Re: What do do? (forums.mtbr.com uses an invalid security certificate) John Doe <always.look@message.header> - 2017-06-08 10:12 +0000
    Re: What do do? (forums.mtbr.com uses an invalid security certificate) Mike Easter <MikeE@ster.invalid> - 2017-06-08 07:41 -0700
    Re: What do do? (forums.mtbr.com uses an invalid security certificate) Mike Easter <MikeE@ster.invalid> - 2017-06-08 09:26 -0700

#4065 — What do do? (forums.mtbr.com uses an invalid security certificate)

I just want to have a normal safe encrypted connection to this web site:
 https://forums.mtbr.com/

But I get this error which is what I'm asking you about:
http://i.cubeupload.com/pNM36t.gif

The error in words is:
 Your connection is not secure.
 The owner of forums.mtbr.com has configured their website improperly.
 To protect your information from being stolen, Tor Browser has
 not connected to this website.
 [Advanced]
 forums.mtbr.com uses an invalid security certificate.
 The certificate is only valid for the following names:
 cloudfront.net,*.cloudfront.net
 Error code: SSL_ERROR_BAD_CERT_DOMAIN
 [Add Exception...]

Should I press "Add Exception"?
All I want is to log into the site in a secure encrypted way.

I'm not sure what is the RIGHT thing to do.

What I did was press the button to download the certificate.
Did I need to do that?

Then I pressed the button to confirm the certificate.

After a bunch of warnings it let me in with dashes along the http.
http://i.cubeupload.com/hUBZXl.gif

Did I do the right steps?
How do I undo what I did if not?

Can someone just explain what is going on to a networking noob?

[toc] | [next] | [standalone]

#4066

harry newton wrote:
> I just want to have a normal safe encrypted connection to this web site:
>  https://forums.mtbr.com/
>
> But I get this error which is what I'm asking you about:
> http://i.cubeupload.com/pNM36t.gif
>
> The error in words is:
>  Your connection is not secure.
>  The owner of forums.mtbr.com has configured their website improperly.
>  To protect your information from being stolen, Tor Browser has
>  not connected to this website.
>  [Advanced]
>  forums.mtbr.com uses an invalid security certificate.
>  The certificate is only valid for the following names:
>  cloudfront.net,*.cloudfront.net
>  Error code: SSL_ERROR_BAD_CERT_DOMAIN
>  [Add Exception...]
>
> Should I press "Add Exception"?
> All I want is to log into the site in a secure encrypted way.

Contact the forum admin -- seems they're using cloudfront as a CDN /
loadbalancer, but the certs are misconfigured.

>
> I'm not sure what is the RIGHT thing to do.

It's a bit of a grey area, honestly.

>
> What I did was press the button to download the certificate.
> Did I need to do that?

Probably - depends on the actual browser (most just allow you to add an
exception on a temporary or permanent basis).

>
> Did I do the right steps?
> How do I undo what I did if not?

For some value of "right".  Revoking the exception depends on the what
the "base" browser is (i.e. Firefox or Chrome), as they each have
slightly different methods for revoking the exception.

>
> Can someone just explain what is going on to a networking noob?

Sparknotes version:
 - You went to website https://forums.somewhere.com
 - The site presented a certificate for https://somewhere-else.com
 - Your browser properly alerted you to the disparity between "expected"
   and "provided" certificates.


-- 
|_|O|_| Registered Linux user #585947
|_|_|O| Github: https://github.com/dpurgert
|O|O|O| PGP: 05CA 9A50 3F2E 1335 4DC5  4AEE 8E11 DDF3 1279 A281

[toc] | [prev] | [next] | [standalone]

#4068

Dan Purgert <dan@djph.net> writes:
> harry newton wrote:
>> I just want to have a normal safe encrypted connection to this web site:
>>  https://forums.mtbr.com/
>>
>> But I get this error which is what I'm asking you about:
>> http://i.cubeupload.com/pNM36t.gif
>>
>> The error in words is:
>>  Your connection is not secure.
>>  The owner of forums.mtbr.com has configured their website improperly.
>>  To protect your information from being stolen, Tor Browser has
>>  not connected to this website.
>>  [Advanced]
>>  forums.mtbr.com uses an invalid security certificate.
>>  The certificate is only valid for the following names:
>>  cloudfront.net,*.cloudfront.net
>>  Error code: SSL_ERROR_BAD_CERT_DOMAIN
>>  [Add Exception...]
>>
>> Should I press "Add Exception"?
>> All I want is to log into the site in a secure encrypted way.
>
> Contact the forum admin -- seems they're using cloudfront as a CDN /
> loadbalancer, but the certs are misconfigured.

Or they’re just not attempting to use https. We don’t know how the OP
got hold the ‘https’ version of the URL in the first place.

-- 
http://www.greenend.org.uk/rjk/

[toc] | [prev] | [next] | [standalone]

#4069

Richard Kettlewell wrote:
> Dan Purgert <dan@djph.net> writes:
>> [...]
>>
>> Contact the forum admin -- seems they're using cloudfront as a CDN /
>> loadbalancer, but the certs are misconfigured.
>
> Or they’re just not attempting to use https. We don’t know how the OP
> got hold the ‘https’ version of the URL in the first place.
>

Good point :)


-- 
|_|O|_| Registered Linux user #585947
|_|_|O| Github: https://github.com/dpurgert
|O|O|O| PGP: 05CA 9A50 3F2E 1335 4DC5  4AEE 8E11 DDF3 1279 A281

[toc] | [prev] | [next] | [standalone]

#4072

On 2017-06-08, Dan Purgert <dan@djph.net> wrote:
> harry newton wrote:
>> I just want to have a normal safe encrypted connection to this web site:
>>  https://forums.mtbr.com/
>>
>> But I get this error which is what I'm asking you about:
>> http://i.cubeupload.com/pNM36t.gif
>>
>> The error in words is:
>>  Your connection is not secure.
>>  The owner of forums.mtbr.com has configured their website improperly.
>>  To protect your information from being stolen, Tor Browser has
>>  not connected to this website.
>>  [Advanced]
>>  forums.mtbr.com uses an invalid security certificate.
>>  The certificate is only valid for the following names:
>>  cloudfront.net,*.cloudfront.net
>>  Error code: SSL_ERROR_BAD_CERT_DOMAIN
>>  [Add Exception...]
>>
>> Should I press "Add Exception"?
>> All I want is to log into the site in a secure encrypted way.
>
> Contact the forum admin -- seems they're using cloudfront as a CDN /
> loadbalancer, but the certs are misconfigured.
>
>>
>> I'm not sure what is the RIGHT thing to do.

It is neither a moral or a legal thing. If you want your connection to
be safe, do not connect.If you want to connect more than you want
security, then make an exception. It is entirely up to you.
>
> It's a bit of a grey area, honestly.
>
>>
>> What I did was press the button to download the certificate.
>> Did I need to do that?

And how do you know it was a valid cert.?


>
> Probably - depends on the actual browser (most just allow you to add an
> exception on a temporary or permanent basis).
>
>>
>> Did I do the right steps?
>> How do I undo what I did if not?
>
> For some value of "right".  Revoking the exception depends on the what
> the "base" browser is (i.e. Firefox or Chrome), as they each have
> slightly different methods for revoking the exception.
>
>>
>> Can someone just explain what is going on to a networking noob?
>
> Sparknotes version:
>  - You went to website https://forums.somewhere.com
>  - The site presented a certificate for https://somewhere-else.com
>  - Your browser properly alerted you to the disparity between "expected"
>    and "provided" certificates.
>
>

[toc] | [prev] | [next] | [standalone]

#4073

On Thu, 2017-06-08, William Unruh wrote:
> On 2017-06-08, Dan Purgert <dan@djph.net> wrote:
>> harry newton wrote:
>>> I just want to have a normal safe encrypted connection to this web site:
>>>  https://forums.mtbr.com/
>>>
>>> But I get this error which is what I'm asking you about:
>>> http://i.cubeupload.com/pNM36t.gif
>>>
>>> The error in words is:
>>>  Your connection is not secure.
>>>  The owner of forums.mtbr.com has configured their website improperly.
>>>  To protect your information from being stolen, Tor Browser has
>>>  not connected to this website.
>>>  [Advanced]
>>>  forums.mtbr.com uses an invalid security certificate.
>>>  The certificate is only valid for the following names:
>>>  cloudfront.net,*.cloudfront.net
>>>  Error code: SSL_ERROR_BAD_CERT_DOMAIN
>>>  [Add Exception...]
>>>
>>> Should I press "Add Exception"?
>>> All I want is to log into the site in a secure encrypted way.
>>
>> Contact the forum admin -- seems they're using cloudfront as a CDN /
>> loadbalancer, but the certs are misconfigured.
>>
>>>
>>> I'm not sure what is the RIGHT thing to do.
>
> It is neither a moral or a legal thing. If you want your connection to
> be safe, do not connect.If you want to connect more than you want
> security, then make an exception. It is entirely up to you.

I suspect the OP is unsure /what/ security is sacrificed by that action.

One of the things that make /me/ unsure is the wording:

>>>  The owner of forums.mtbr.com has configured their website improperly.

That seems to imply that the cert came from forums.mtbr.com, so a
man-in-the-middle attack is not possible, or?  Note that I know
a bit about security, but almost nothing about SSL.

/Jorgen

-- 
  // Jorgen Grahn <grahn@  Oo  o.   .     .
\X/     snipabacken.se>   O  o   .

[toc] | [prev] | [next] | [standalone]

#4074

Jorgen Grahn <grahn+nntp@snipabacken.se> writes:
> One of the things that make /me/ unsure is the wording:
>
>>>>  The owner of forums.mtbr.com has configured their website improperly.
>
> That seems to imply that the cert came from forums.mtbr.com, so a
> man-in-the-middle attack is not possible, or?  Note that I know
> a bit about security, but almost nothing about SSL.

The certificate was physically transmitted from something answering to
https://forums.mtbr.com, but the (key, name) binding it represents has
nothing to do with forums.mtbr.com.

Misconfiguration is one possible explanation (and probably sort of true
here; I suspect what’s going on is that the site owner hasn’t enabled
TLS for the CDN they use). The other possibility would be an attack with
the attacker hoping that the user will talk themselves into ignoring the
error.

What you actually get from https://forums.mtbr.com is a redirect to
http://forums.mtbr.com:

  $ curl -kD /dev/stdout https://forums.mtbr.com
  HTTP/1.1 303 See Other
  Content-Type: text/html; charset=UTF-8
  Transfer-Encoding: chunked
  Connection: keep-alive
  Date: Fri, 09 Jun 2017 08:53:00 GMT
  Server: nginx/1.10.2
  X-Powered-By: PHP/5.6.30
  Set-Cookie: bb_sessionhash=50c1915035f59fae5e618dc5526b99f0; path=/; domain=.mtbr.com; HttpOnly
  Set-Cookie: bb_lastvisit=1496998380; expires=Sat, 09-Jun-2018 08:53:00 GMT; Max-Age=31536000; path=/; domain=.mtbr.com
  Set-Cookie: bb_lastactivity=0; expires=Sat, 09-Jun-2018 08:53:00 GMT; Max-Age=31536000; path=/; domain=.mtbr.com
  Location: http://forums.mtbr.com/forum.php?s=50c1915035f59fae5e618dc5526b99f0
  X-Cache: Miss from cloudfront
  Via: 1.1 cf6fc03068694d1620f3d26ee4b15944.cloudfront.net (CloudFront)
  X-Amz-Cf-Id: vBCBZXo11my4Mc_tWVrZLbmNL6XuJUC3zWoozRUCeL63itsLGkkMMA==

...so if the CDN theory is true then the answer to the OP’s original
question is:

>>>> I just want to have a normal safe encrypted connection to this web site:
>>>>  https://forums.mtbr.com/

You can’t have that.

-- 
http://www.greenend.org.uk/rjk/

[toc] | [prev] | [next] | [standalone]

#4067

MTBR sucks anyway.

Try a better forum...

http://www.bikeforums.net




-- 

harry newton <harry@is.invalid> wrote:

> I just want to have a normal safe encrypted connection to this web site:
>  https://forums.mtbr.com/
> 
> But I get this error which is what I'm asking you about:
> http://i.cubeupload.com/pNM36t.gif
> 
> The error in words is:
>  Your connection is not secure.
>  The owner of forums.mtbr.com has configured their website improperly.
>  To protect your information from being stolen, Tor Browser has
>  not connected to this website.
>  [Advanced]
>  forums.mtbr.com uses an invalid security certificate.
>  The certificate is only valid for the following names:
>  cloudfront.net,*.cloudfront.net
>  Error code: SSL_ERROR_BAD_CERT_DOMAIN
>  [Add Exception...]
> 
> Should I press "Add Exception"?
> All I want is to log into the site in a secure encrypted way.
> 
> I'm not sure what is the RIGHT thing to do.
> 
> What I did was press the button to download the certificate.
> Did I need to do that?
> 
> Then I pressed the button to confirm the certificate.
> 
> After a bunch of warnings it let me in with dashes along the http.
> http://i.cubeupload.com/hUBZXl.gif
> 
> Did I do the right steps?
> How do I undo what I did if not?
> 
> Can someone just explain what is going on to a networking noob?

[toc] | [prev] | [next] | [standalone]

#4070

harry newton wrote:
> I just want to have a normal safe encrypted connection to this web site:
>   https://forums.mtbr.com/
> 
> But I get this error which is what I'm asking you about:
> http://i.cubeupload.com/pNM36t.gif

Optimally they should straighten out their certificate situation.

> The error in words is:
>   Your connection is not secure.
>   The owner of forums.mtbr.com has configured their website improperly.
>   To protect your information from being stolen, Tor Browser has
>   not connected to this website.
>   [Advanced]
>   forums.mtbr.com uses an invalid security certificate.
>   The certificate is only valid for the following names:
>   cloudfront.net,*.cloudfront.net
>   Error code: SSL_ERROR_BAD_CERT_DOMAIN
>   [Add Exception...]
> 
> Should I press "Add Exception"?
> All I want is to log into the site in a secure encrypted way.
> 
> I'm not sure what is the RIGHT thing to do.

Moz/Ffx has a pretty good page 
https://support.mozilla.org/en-US/kb/what-does-your-connection-is-not-secure-mean

Table of Contents
     What to do if you see this error?
     Technical information
         The certificate will not be valid until (date)
         The certificate expired on (date)
         The certificate is not trusted because the issuer certificate 
is unknown
         The certificate is not trusted because it is self-signed
         The certificate is only valid for (site name)
         Corrupted certificate store
     Bypassing the warning
     Reporting the Error

> What I did was press the button to download the certificate.
> Did I need to do that?

Only if you want to go someplace which has a screwed up certificate.

> Then I pressed the button to confirm the certificate.
> 
> After a bunch of warnings it let me in with dashes along the http.
> http://i.cubeupload.com/hUBZXl.gif
> 
> Did I do the right steps?
> How do I undo what I did if not?
> 
> Can someone just explain what is going on to a networking noob?

A site that is going to use https has to have a proper certificate or 
they shouldn't use https. If the site is using some certificate that 
isn't actually theirs to use, then they should straighten that out.


-- 
Mike Easter

[toc] | [prev] | [next] | [standalone]

#4071

harry newton wrote:
> I just want to have a normal safe encrypted connection to this web site:
>   https://forums.mtbr.com/

You can access those forums without cert at http.

You can communicate with the domain holder about certs, but others have 
communicated the problem as far back as 2007.  The explanation response 
wasn't clear to me.

Nowadays one can use Let's Encrypt to save money on certs so maybe it 
would be easier for them to fix now.


-- 
Mike Easter

[toc] | [prev] | [standalone]

Back to top | Article view | comp.os.linux.networking

csiph-web