Hello guys, New here, but I’ve used Let’s Encrypt for a while. I have a Digital Ocean droplet with Debian 9 / Nginx, and I used certbot to create an SSL certificate for one of my website. The certificate is working fine on my side and on every device. It’s doing fine on SSLlabs too. But a friend …

If your traffic is being intercepted, you can find more information about who is responsible by checking what certificate is being offered: openssl s_client -connect helloworld.letsencrypt.org:443 -servername helloworld.letsencrypt.org -showcerts 2>&1 | openssl x509 -noout -subject -issuer -serial …

Thanks for the answer. So, I get that: Using my VPN: subject= /CN=s***.t*** issuer= /C=US/O=Let’s Encrypt/CN=Let’s Encrypt Authority X3 serial=03C33C4A8586F58DC0F6CAA141C89C20507D not using any VPN: subject= /CN=fake/O=My Company Name LTD./C=US issuer= /CN=fake/O=My Company Name LTD./C=US se…

Looks bad, a man in the middle. May be a virus, the company, who owns the pc, an anti-virus or someone else. Read this thread: [image] Privacy Error Flag on let's encrypt protected sites since May 25, 2018 Help H…

[image] JuergenAuer: Looks bad, a man in the middle. May be a virus, the company, who owns the pc, an anti-virus or someone else. Read this thread: :dizzy_face: The PC is quite new. And he have the same problem on his cellphone, using a 4G connexion. So I guess it's the russian government …

[image] studiomug: So I guess it’s the russian government that is blocking. It's not a direct blocking. The man in the middle can't insert a new root certificate (this is good), so the chain error is visible.

Yes. What would be the purpose of doing that? There is two strange facts: the problem happens only on this website. I have other website with the exact same configurations and it’s working fine; the website is working fine in Chrome’s private mode.

[image] studiomug: the problem happens only on this website. I have other website with the exact same configurations and it’s working fine; Sure? Did he check the certificate chain? Perhaps there is an old fake root certificate -> no error, man in the middle works perfect :frowning:

Yes, he is using other websites that have certbot certificates as well. He sent me this: [image]

The site IP belongs to one of Digital Ocean, Inc subnets which is blocked by RKN, so the problem occurs when ISP redirects blocked ip to some block-info page, and of course certificate for this site in that case is not valid for this domain.

I’ve checked and it’s true… DigitalOcean is banned in Russia…

Not working in Russia?

Help

JuergenAuer June 18, 2018, 4:41pm 4

Looks bad, a man in the middle.

May be a virus, the company, who owns the pc, an anti-virus or someone else.

Read this thread:

Topic		Replies	Views
Certificates are issued strangely Help	14	679	August 25, 2022
Help me resolve this problem Help	26	4356	April 16, 2023
requests.packages.urllib3.exceptions.SSLError Debian 9 Server	14	3351	January 2, 2019
Invalid and valid in same browser Help	3	1044	February 8, 2020
Can't create certificate Help	27	9387	April 26, 2016

Not working in Russia?

Related topics