Google, Opera and Explorer https malfunction

jps1 · January 16, 2019, 12:07pm

Hello,

My domains are www.ekumen.net and www.ekumen.eu. Everything works on all browsers on my home desktop.
But on my laptop running on windows 7, only firefox is working well.
On google chrome, when I use one of these urls, I obtain this message : NET::ERR_CERT_AUTHORITY_INVALID
Same problem with Opera and IE.

I tried quite everything : empty the cache, stop the avast antivirus, reinstall chrome… Nothing changes.
This problem only appears on my laptop : I haven’t seen this problem on any browser on the other PCs.

What do you think I should do ?

Thanks

JuergenAuer · January 16, 2019, 12:25pm

Hi @jps1

your certificate is correct:

CN=www.ekumen.net
	03.01.2019
	03.04.2019
	ekumen.net, www.ekumen.net - 2 entries

valide, with two domain names. Both connections use the certificate.

So:

Which Chrome-version is installed? If Chrome is too old, perhaps something is missing.

There should be a button "Detailed" or "Additional Informations". What's there?

jps1 · January 16, 2019, 12:28pm

Thank you, Jürgen. I have the latest Chrome version (installed this morning).

The details message is :
Can not verify on the server that this is the domain www.ekumen.eu, because its security certificate is not considered reliable by the operating system of your computer. This may be due to a misconfiguration or the interception of your connection by a hacker.

tdelmas · January 16, 2019, 12:30pm

As Firefox uses it’s own certificate store and Chrome/IE the one of the Operating system, it may be a problem with windows. Or an antivirus doing a MitM. Is your windows up to date? Are your antivirus up to date?

A screenshot of the certificate may help: https://www.ssl2buy.com/wiki/how-to-view-ssl-certificate-details-on-chrome-56

jps1 · January 16, 2019, 12:40pm

Thank you, tdelmas (Thomas I suppose).
My Avast is up to date, but I cannot be sur that my windows 7 is OK.
I check this point and come back to you

tdelmas · January 16, 2019, 12:49pm

Almost, Tom
Can you take a picture of the "Chemin d'acces de certification" tab? Merci!

jps1 · January 16, 2019, 2:09pm

Hi, Tom,

Here it is.

jps1 · January 16, 2019, 2:11pm

And a complement.

tdelmas · January 16, 2019, 2:17pm

So it doesn't seams to be a MitM, the chain seams to be correct.

Windows should trust DST Root CA X3... Somebody else seams to have the same problem [solved] Unable to access sites certified by Lets Encrypt .Windows 7 - #7 by wartburg

Can you check that: TLS connection to letsencrypt.org fails with Chromium and IE - #10 by rugk ?

It was caused by a setting I had modified. I disabled “Automatic Root Certificates Update ” (link 2 ) which is a technology of Windows to fetch missing root certificates from the Windows update servers to import them into the root certificate store.

tdelmas · January 16, 2019, 2:18pm

And can you test that website too? helloworld.letsencrypt.org (just to be sure)

jps1 · January 16, 2019, 2:28pm

Does not work either

JuergenAuer · January 16, 2019, 3:01pm

Open the DST certificate.

Go to details. Save it in a file.

Then open the file, Windows should ask to import it.

rg305 · January 16, 2019, 3:14pm

It sounds like Windows hasn't been updated in quite some time.
Perhaps a "Windows Update" is in order.

jps1 · January 22, 2019, 12:56pm

Hello,
I finished to update completely my PC with the last windows 7 updates.
Still does not work.

Do you have a solution ?

rg305 · January 22, 2019, 12:57pm

You could manually import the root cert into the trusted roots…

jps1 · January 22, 2019, 12:59pm

That could be a good idea. Do you have a good one I could import ? And where should I copy it ?

rg305 · January 22, 2019, 1:09pm

It’s relatively easy in Windows.
Which browser are you using?
[The steps are somewhat different for each]

rg305 · January 22, 2019, 1:31pm

Probably simplest in Chrome, but generally:
While pointing at this very site, click the lock and view the cert.
Find the root cert (“DST Root CA X3”) and save it to a file.
(make sure it ends with .cer or .crt)
[It should look like the text below]
Double-click the saved file and install the cert into the “local machine”.
“Place … in the following store”
browse
“Trusted Root Certificate Authorites”

DST Root CA X3

jps1 · January 22, 2019, 3:37pm

OK, I try that and reply to you !

jps1 · January 22, 2019, 5:26pm

Problem solved ! You are a champion !
Thank you very much !