Hi all.

For one particular website, I find firefox refuses sometimes to load
pages, claiming "Peer’s Certificate has been revoked".

This seems to occur a bit intermittently - sometimes a page from the
site will load, but then reloading will cause the error.

OTOH chromium will load the site, although it moans about some scripts
and styles being on http and refuses to use those (the site as a whole
loads though).

Website in question is https://www.churchlangleychurch.org/ and I've
spoken to one of the maintainers who says he believes the security cert
is current.

Can anyone shed light on this behaviour please?

Thanks.

(ff 122.0 under mint, but it also happens with firefox running under
win10, so it seems not to be OS-related.)

--
Mike Scott
Harlow, England

On 2/6/24 7:09 AM, Mike Scott wrote:
> Hi all.
>
> For one particular website, I find firefox refuses sometimes to load
> pages, claiming "Peer’s Certificate has been revoked".
>
> This seems to occur a bit intermittently - sometimes a page from the
> site will load, but then reloading will cause the error.
>
> OTOH chromium will load the site, although it moans about some scripts
> and styles being on http and refuses to use those (the site as a whole
> loads though).
>
> Website in question is https://www.churchlangleychurch.org/ and I've
> spoken to one of the maintainers who says he believes the security
> cert is current.
>
>
> Can anyone shed light on this behaviour please?
>
> Thanks.
>
> (ff 122.0 under mint, but it also happens with firefox running under
> win10, so it seems not to be OS-related.)
>
This what I Get

Secure Connection Failed

An error occurred during a connection to www.churchlangleychurch.org.
Peer’s Certificate has been revoked.

Error code: SEC_ERROR_REVOKED_CERTIFICATE

    The page you are trying to view cannot be shown because the
authenticity of the received data could not be verified.
    Please contact the website owners to inform them of this problem.

FF 116.0.3 (64-bit)

On 2/6/24 07:21 AM, Nic wrote:
> On 2/6/24 7:09 AM, Mike Scott wrote:
>> Hi all.
>>
>> For one particular website, I find firefox refuses sometimes to load pages, claiming "Peer’s
>> Certificate has been revoked".
>>
>> This seems to occur a bit intermittently - sometimes a page from the site will load, but then
>> reloading will cause the error.
>>
>> OTOH chromium will load the site, although it moans about some scripts and styles being on http
>> and refuses to use those (the site as a whole loads though).
>>
>> Website in question is https://www.churchlangleychurch.org/ and I've spoken to one of the
>> maintainers who says he believes the security cert is current.
>>
>>
>> Can anyone shed light on this behaviour please?
>>
>> Thanks.
>>
>> (ff 122.0 under mint, but it also happens with firefox running under win10, so it seems not to be
>> OS-related.)
>>
> This what I Get
>
> Secure Connection Failed
>
> An error occurred during a connection to www.churchlangleychurch.org. Peer’s Certificate has been
> revoked.
>
> Error code: SEC_ERROR_REVOKED_CERTIFICATE
>
>     The page you are trying to view cannot be shown because the authenticity of the received data
> could not be verified.
>     Please contact the website owners to inform them of this problem.
>
> FF 116.0.3 (64-bit)
A drilldown on the small icon in the url bar allows inspection of page info.

Website Identity:
Owner: This website does not supply ownership information.

Tech Details:
Connection Not Encrypted
The page you are viewing was not encrypted before being transmitted over the Internet.
Information sent over the Internet without encryption can be seen by other people whit it is in
transit.
A help Button with this link:
https://support.mozilla.org/en-US/kb/firefox-page-info-window?as=u&utm_source=inproduct&redirectslug=Page+Info+window&redirectlocale=en-US#Security

(long link wraps)

Really does look like the website owner is not doing something right, or doesn't have total control
of site. Maybe he farms it out and doesn't really do more than content.
--
Linux Mint 21.2 Cinnamon
Al

Mike Scott wrote:
> Hi all.
>
> For one particular website, I find firefox refuses sometimes to load
> pages, claiming "Peer’s Certificate has been revoked".
>
> This seems to occur a bit intermittently - sometimes a page from the
> site will load, but then reloading will cause the error.
>
> OTOH chromium will load the site, although it moans about some scripts
> and styles being on http and refuses to use those (the site as a whole
> loads though).
>
> Website in question is https://www.churchlangleychurch.org/ and I've
> spoken to one of the maintainers who says he believes the security cert
> is current.
>
>
> Can anyone shed light on this behaviour please?

The site does work in Opera with the VPN activated. All my other
browsers (LibreWolf, Seamonkey, Vivaldi) refuse the connection too.

06-02-2024 om 13:09; Mike Scott:
> For one particular website, I find firefox refuses sometimes to load
> pages, claiming "Peer’s Certificate has been revoked".

The intermittent bit is surprising. Perhaps some pages were in cache?

> Website in question is https://www.churchlangleychurch.org/ and I've
> spoken to one of the maintainers who says he believes the security cert
> is current.

It is, in that it's not expired.

If you're on Linux you can do some digging. First, use OpenSSL to check
the certificate by connecting to the site:

$ openssl s_client -showcerts -servername www.churchlangleychurch.org
-connect www.churchlangleychurch.org:443 </dev/null

This gives lots of output, and everything appears to be in order. The
site certificate is shown in .pem format; copy that to a file (say
cert.pem), and display its contents to determine the certificate serial
number and revocation list location:

$ openssl x509 -noout -text -in cert.pem
[...]
Serial Number: 5158205243980326711 (0x4795a0570e012737)
[...]
Validity
Not Before: Apr 5 07:53:28 2023 GMT
Not After : May 6 07:53:28 2024 GMT
[...]
X509v3 CRL Distribution Points:
Full Name:
URI:http://crl.starfieldtech.com/sfig2s1-558.crl
[...]

Now we can check whether the certificate is revoked:

$ openssl crl -noout -text -in
http://crl.starfieldtech.com/sfig2s1-558.crl | grep -iA 4 4795a0570e012737
Serial Number: 4795A0570E012737
Revocation Date: Apr 8 13:22:23 2023 GMT
CRL entry extensions:
X509v3 CRL Reason Code:
Superseded

So, this certificate is indeed revoked, 3 days after its validity start
date, and the reason is "Superseded". Could it be that a new version of
the certificate has been issued, but not implemented properly?

Regards,
Gertjan.

On 2/6/2024 7:09 AM, Mike Scott wrote:
> Hi all.
>
> For one particular website, I find firefox refuses sometimes to load pages, claiming "Peer’s Certificate has been revoked".
>
> This seems to occur a bit intermittently - sometimes a page from the site will load, but then reloading will cause the error.
>
> OTOH chromium will load the site, although it moans about some scripts and styles being on http and refuses to use those (the site as a whole loads though).
>
> Website in question is https://www.churchlangleychurch.org/ and I've spoken to one of the maintainers who says he believes the security cert is current.
>
>
> Can anyone shed light on this behaviour please?
>
> Thanks.
>
> (ff 122.0 under mint, but it also happens with firefox running under win10, so it seems not to be OS-related.)
>

A site owner, can get a hint here.

https://www.ssllabs.com/ssltest/analyze.html?d=churchlangleychurch.org

Issuer Starfield Secure Certificate Authority - G2
AIA: http://certificates.starfieldtech.com/repository/sfig2.crt

Revocation status Revoked INSECURE

Trusted No NOT TRUSTED (Why?)
Mozilla Apple Android Java Windows <=== trust failure, on these platforms

Paul

On 2/6/24 3:55 PM, Paul wrote:
> On 2/6/2024 7:09 AM, Mike Scott wrote:
>> Hi all.
>>
>> For one particular website, I find firefox refuses sometimes to load pages, claiming "Peer’s Certificate has been revoked".
>>
>> This seems to occur a bit intermittently - sometimes a page from the site will load, but then reloading will cause the error.
>>
>> OTOH chromium will load the site, although it moans about some scripts and styles being on http and refuses to use those (the site as a whole loads though).
>>
>> Website in question is https://www.churchlangleychurch.org/ and I've spoken to one of the maintainers who says he believes the security cert is current.
>>
>>
>> Can anyone shed light on this behaviour please?
>>
>> Thanks.
>>
>> (ff 122.0 under mint, but it also happens with firefox running under win10, so it seems not to be OS-related.)
>>
> A site owner, can get a hint here.
>
> https://www.ssllabs.com/ssltest/analyze.html?d=churchlangleychurch.org
>
> Issuer Starfield Secure Certificate Authority - G2
> AIA: http://certificates.starfieldtech.com/repository/sfig2.crt
>
> Revocation status Revoked INSECURE
>
> Trusted No NOT TRUSTED (Why?)
> Mozilla Apple Android Java Windows <=== trust failure, on these platforms
>
> Paul
When I search for

Starfield Secure Certificate Authority, I get

C=US
ST=Arizona
L=Scottsdale
O=Starfield Technologies, Inc.
CN=Starfield Root Certificate Authority - G2

Maybe someday the inquiring roving eye can look into the lives of the
people who make up Starfield Authorities.

Starfield Secure Certificate Authority

Starfield Secure Certificate Authority

On 2/6/24 4:40 PM, Nic wrote:
> On 2/6/24 3:55 PM, Paul wrote:
>> On 2/6/2024 7:09 AM, Mike Scott wrote:
>>> Hi all.
>>>
>>> For one particular website, I find firefox refuses sometimes to load
>>> pages, claiming "Peer’s Certificate has been revoked".
>>>
>>> This seems to occur a bit intermittently - sometimes a page from the
>>> site will load, but then reloading will cause the error.
>>>
>>> OTOH chromium will load the site, although it moans about some
>>> scripts and styles being on http and refuses to use those (the site
>>> as a whole loads though).
>>>
>>> Website in question is https://www.churchlangleychurch.org/ and I've
>>> spoken to one of the maintainers who says he believes the security
>>> cert is current.
>>>
>>>
>>> Can anyone shed light on this behaviour please?
>>>
>>> Thanks.
>>>
>>> (ff 122.0 under mint, but it also happens with firefox running under
>>> win10, so it seems not to be OS-related.)
>>>
>> A site owner, can get a hint here.
>>
>> https://www.ssllabs.com/ssltest/analyze.html?d=churchlangleychurch.org
>>
>>     Issuer       Starfield Secure Certificate Authority - G2
>>     AIA: http://certificates.starfieldtech.com/repository/sfig2.crt
>>
>>     Revocation status    Revoked   INSECURE
>>
>>     Trusted              No   NOT TRUSTED (Why?)
>>                               Mozilla  Apple  Android  Java Windows 
>> <=== trust failure, on these platforms
>>
>>    Paul
> When I search for
>
> Starfield Secure Certificate Authority, I get
>
> C=US
> ST=Arizona
> L=Scottsdale
> O=Starfield Technologies, Inc.
> CN=Starfield Root Certificate Authority - G2
>
> Maybe someday the inquiring roving eye can look into the lives of the
> people who make up Starfield Authorities.
>
> Starfield Secure Certificate Authority
>
> Starfield Secure Certificate Authority
>
https://ssl-tools.net/subjects/14c0f884650ebfb1564d3da153a0d7f1c7c670a8
Experts and authorities can explain everything.

Fingerprints: |9565b778c8| |b51c067cee|

Issuer:
OU=Starfield Cla­ss 2 Certificati­on Authority,O=S­tarfield
Technol­ogies\, Inc.,C=U­S
CN=Starfield Roo­t Certificate Au­thority - G2,O=S­tarfield
Technol­ogies\, Inc.,L=S­cottsdale,ST=Ari­zona,C=US
Serial:
3740804
0
Not valid before:
2014-01-01 07:00­:00 UTC
2009-09-01 00:00­:00 UTC
Not valid after:
2031-05-30 07:00­:00 UTC
2037-12-31 23:59­:59 UTC
Key size:
2048
Signature Algorithm:
sha256WithRSAEnc­ryption

basicConstraints:
CA:TRUE
keyUsage:
Certificate Sign­, CRL Sign
subjectKeyIdentifier:
7C:0C:32:1F:A7:D­9:30:7F:C4:7D:68­:A3:62:A8:A1:CE:­AB:07:5B:27
authorityKeyIdentifier:
keyid:BF:5F:B7:D­1:CE:DD:1F:86:F4­:5B:55:AC:DC:D7:­10:C2:0E:A9:88:E­7
authorityInfoAccess:
OCSP - URI:http:­//ocsp.starfield­tech.com/
crlDistributionPoints:
Full Name:­ URI:http://crl­.starfieldtech.c­om/sfroot.crl
certificatePolicies:
Policy: X509v3 A­ny Policy­ CPS:
https://c­erts.starfieldte­ch.com/repositor­y/

Certificates

Fingerprint Issuer Serial Public Key Download Tools
9565­b778­c8a5­0eb4­fefd­45c8­a658­dde2­411e­ad0a Starfield Class 2
Certification Authority
<https://ssl-tools.net/subjects/8bc19e845b981d61cf5469211a68b8e311336d90>
3740­804 9565b778c8

b51c­067c­ee2b­0c3d­f855­ab2d­92f4­fe39­d4e7­0f0e self signed 0
b51c067cee

Graph

On 06/02/2024 20:55, Paul wrote:
> On 2/6/2024 7:09 AM, Mike Scott wrote:
>> Hi all.
>>
>> For one particular website, I find firefox refuses sometimes to load pages, claiming "Peer’s Certificate has been revoked".
>>
>> This seems to occur a bit intermittently - sometimes a page from the site will load, but then reloading will cause the error.
>>
>> OTOH chromium will load the site, although it moans about some scripts and styles being on http and refuses to use those (the site as a whole loads though).
>>
>> Website in question is https://www.churchlangleychurch.org/ and I've spoken to one of the maintainers who says he believes the security cert is current.
>>
>>
>> Can anyone shed light on this behaviour please?
>>
>> Thanks.
>>
>> (ff 122.0 under mint, but it also happens with firefox running under win10, so it seems not to be OS-related.)
>>
>
> A site owner, can get a hint here.
>
> https://www.ssllabs.com/ssltest/analyze.html?d=churchlangleychurch.org
>
> Issuer Starfield Secure Certificate Authority - G2
> AIA: http://certificates.starfieldtech.com/repository/sfig2.crt
>
> Revocation status Revoked INSECURE
>
> Trusted No NOT TRUSTED (Why?)
> Mozilla Apple Android Java Windows <=== trust failure, on these platforms
>
> Paul

My thanks to all for responses, and especially to you and to Gertjan for
the concrete information.

I've taken a look (although to my decades out-of-date knowledge it's all
a tad complex) and passed the info back to the site maintainers (who are
possible worse of than I in that respect).

Two questions though:

I'm not clear what
> Trusted No NOT TRUSTED (Why?)
> Mozilla Apple Android Java Windows
<=== trust failure, on these platforms

implies.

And how come it all works /sometimes/? If the cert is dead, should https
not fail solidly?

Thanks again.

--
Mike Scott
Harlow, England

On 2024-02-07, Mike Scott wrote:
> [...]
> And how come it all works /sometimes/? If the cert is dead, should https
> not fail solidly?

Not if they (their provider) has a "HA" setup ("High Availability", i.e.
2+ webservers), with (at least) one being misconfigured. If it's from
the provider, this would likely be invisible to the website
owner/maintainer.

--
|_|O|_|
|_|_|O| Github: https://github.com/dpurgert
|O|O|O| PGP: DDAB 23FB 19FA 7D85 1CC1 E067 6D65 70E5 4CE7 2860