Google Chrome message - your connection is not private

Blanco100

Getting this message this morning when I try and enter google.ie or access my gmail

the full message is:

attackers might be trying to steal your information from google.ie (for example passwords, messages, or credit cards). NET::ERR_CERT_WEAK_SIGNATURE_ALGORITHM

I've deleted history, synced correct date etc but no dice. Even trying to log into boards throws up this error message in chrome. Boards.ie can be accessed but hit the login button and the error message shows up again

Any ideas what the problem is here?

srsly78

Corporate proxy can cause this message. If you surf internet in work this warning is telling you they can read your mail etc (mitm attack).

Blanco100

i'm not in work though i'm using a personal laptop.

The other laptop in the house isn't having the same issues though, its working fine.

srsly78

Probably malware on laptop so.

Blanco100

Ran an anti virus scan there and nothing showing up at all its a strange one

srsly78

Your antivirus might be crap. Have you got loads of dodgy browser extensions installed?

Blanco100

srsly78 wrote: »

Your antivirus might be crap. Have you got loads of dodgy browser extensions installed?

no extensions at all, I never have extensions. Completely baffled to be honest, it was working perfectly fine last night

srsly78

Your antivirus might actually be the cause of the error, try disabling it and see if it goes away. What are you using?

https://productforums.google.com/forum/#!topic/chrome/-LjiIraWUqk

Usually error is caused by website with obsolete cert, or old version of chrome.

kierank01

Is the version of chrome the same on both machines?

newer versions of chrome are more strict on older https certificates, and are warning you that the encryption is not as good as it used to be.

the site that you are connecting to should upgrade their certificate

Blanco100

srsly78 wrote: »

Your antivirus might actually be the cause of the error, try disabling it and see if it goes away. What are you using?

https://productforums.google.com/forum/#!topic/chrome/-LjiIraWUqk

Usually error is caused by website with obsolete cert, or old version of chrome.

im using microsoft security essentials

the other laptop is using the exact same but is able to use google chrome perfectly fine

srsly78

It's probably a bug in that specific version of chrome, lots of people complaining. Try updating or rolling back. Or try firefox if it really annoys you.

Blanco100

kierank01 wrote: »

Is the version of chrome the same on both machines?

newer versions of chrome are more strict on older https certificates, and are warning you that the encryption is not as good as it used to be.

the site that you are connecting to should upgrade their certificate

yeah same version of chrome on both machines ive checked that

Blanco100

srsly78 wrote: »

Your antivirus might actually be the cause of the error, try disabling it and see if it goes away. What are you using?

https://productforums.google.com/forum/#!topic/chrome/-LjiIraWUqk

Usually error is caused by website with obsolete cert, or old version of chrome.

ive temporarily disabled the micosoft security essentials and its still throwing up the error message

Spear

Show us the complete cert that you're seeing for google.ie or gmail when it complains.

Blanco100

Spear wrote: »

Show us the complete cert that you're seeing for google.ie or gmail when it complains.

Here it is. Its the same message thrown up when trying to access facebook, log in to boards etc..

srsly78

Lolll not clicking on a dodgy word document attachment

Blanco100

srsly78 wrote: »

Lolll not clicking on a dodgy word document attachment

what should I save it as? apologies for inconvenience

srsly78

As an image or plain text is fine.

Blanco100

Spear

Blanco100 wrote: »

That image is tiny, was it meant to be that size?

Spear

We need to see the cert itself. Open https://gmail.com, and let it complain, then press F12, go to the security tab, and the cert will be available there.

kierank01

what happens if you do a tracert to www.google.ie? does it take the same path, does it go to the same destination?

Blanco100

Spear wrote: »

We need to see the cert itself. Open https://gmail.com, and let it complain, then press F12, go to the security tab, and the cert will be available there.

Nothing happens when I press f12, is there another way into the security tab?

Its not just gmail it won't let me open though, its facebook, even boards (only when I try to login to boards though)

Blanco100

kierank01 wrote: »

what happens if you do a tracert to www.google.ie? does it take the same path, does it go to the same destination?

Pardon my IT illiteracy but what do you mean by tracert?

Spear

Ctrl+shift+j should do the same thing.

Blanco100

Spear wrote: »

Ctrl+shift+j should do the same thing.

That has opened something, however what is it i'm supposed to be specifically looking for?

Spear

That's the dev console, you'll have a set of tabs along the top of it, with security being towards the right.

Blanco100

Spear wrote: »

That's the dev console, you'll have a set of tabs along the top of it, with security being towards the right.

I've found that now and I see the certificates

What am I looking for exactly if I may ask?

Spear

Grab the stuff under secure connection, just copy and paste the text here. That'll give the cipher choice to begin with.

Then hit view cert, and the first page that appears should give some basic details (issuer, date etc), copy and paste those too.

Blanco100

Spear wrote: »

Grab the stuff under secure connection, just copy and paste the text here. That'll give the cipher choice to begin with.

Then hit view cert, and the first page that appears should give some basic details (issuer, date etc), copy and paste those too.

This is what appears under Security overview. The other 2 options are greyed out


Certificate Error
There are issues with the site's certificate chain (net::ERR_CERT_WEAK_SIGNATURE_ALGORITHM).
View certificate

SHA-1 Certificate
The certificate chain for this site contains a certificate signed using SHA-1.
View certificate

Secure Resources
All resources on this page are served securely.



Obsolete Connection Settings
The connection to this site uses a strong protocol (TLS 1.2), an obsolete key exchange (RSA), and a strong cipher (AES_128_GCM).

Blanco100

It also says "This page is not secure (Broken HTTPS)"

Spear

Googe's current certs are SHA256, not SHA1, which browsers will increasingly object to, as you're seeing now.

Hit the view cert button and grab those details too.

Blanco100

Spear wrote: »

Googe's current certs are SHA256, not SHA1, which browsers will increasingly object to, as you're seeing now.

Hit the view cert button and grab those details too.

How come the other laptop (exact same model) is working perfectly though?

When I hit "view cert" what info do you need? its not allowing me to copy and paste that info

Spear

Blanco100 wrote: »

How come the other laptop (exact same model) is working perfectly though?

When I hit "view cert" what info do you need? its not allowing me to copy and paste that info

A screen shot of the cert info would do.

But I want to see what cert it's using and where it's coming from. The fact that the other laptop doesn't would seem to suggest it's something local to the machine in question.

Blanco100

There are 3 tabs -General-Details-Certification path

Spear

General is fine to start with.

Blanco100

Blanco100

tried uploading screenshot not sure its working

Blanco100

Spear

It won't embed as you're linking to the page, not the image. But the image is still tiny.

Blanco100

I should also point out that in the last hour my computer has been unable to establish a wifi connection whatsoever. The only means of accessing the internet on the laptop in question is via an ethernet cable, this has never been the case before.

The other laptop remains working fine, the wifi network appears straight away on boot up

Cannot figure this out at all

Blanco100

Can you see the small image on the first or second post above?

jimmycrackcorm

Blanco100 wrote:

attackers might be trying to steal your information from google.ie (for example passwords, messages, or credit cards). NET::ERR_CERT_WEAK_SIGNATURE_ALGORITHM

This is caused by the website still using an old sha-1 certificate. Chrome update 56 I think started checking for this. Use IE or Firefox, and complain to the site.

Spear

Blanco100 wrote: »

Can you see the small image on the first or second post above?



http://i65.tinypic.com/34evj1c.png

It's a little hard to make out, but does that issue say MS-NMSecurity ?

Blanco100

jimmycrackcorm wrote: »

This is caused by the website still using an old sha-1 certificate. Chrome update 56 I think started checking for this. Use IE or Firefox, and complain to the site.

But as i've said previously, another laptop in the house (exact same laptop, which same version of chrome etc) is working fine and can run chrome.

My own laptop now seems to also be unable to pick up any wifi connections, I am presuming this is linked to the problem with chrome

Suckit

What is the date and time on your PC?

Can see it screens.

Blanco100

Spear wrote: »

It's a little hard to make out, but does that issue say MS-NMSecurity ?

yes it does

valid from 29/03/2017 to 21/06/2017

my wifi connection is gone now aswell, not even recognising it to be honest

Blanco100

Suckit wrote: »

What is the date and time on your PC?

thats all in order, I did a google search and saw that was one of the common fixes but its all in order.

It was working perfectly fine up until this morning

Spear

Blanco100 wrote: »

yes it does

valid from 29/03/2017 to 21/06/2017

my wifi connection is gone now aswell, not even recognising it to be honest

So while the dates matches the recent Google certs, that's not the issuer.

So something is acting as a proxy, but I'm not familiar enough with MS Security Essentials to say if that's how their certs appear.

Riesen_Meal

Could your chrome be corrupted?

The wee men in our house downloaded some virus ridden yoke and it corrupted Chrome even after I got rid of the virus, in the end I just uninstalled and reinstalled chrome and it was fine....

Edit : now I think of it, security essentials didn't pick it up, but adwcleaner did...

kierank01

if you hit the certification path, post that, and then do all the same on the other laptop.