{"id":3119,"date":"2016-10-14T10:19:20","date_gmt":"2016-10-14T10:19:20","guid":{"rendered":"https:\/\/www.thesslstore.com\/blog\/?p=3119"},"modified":"2023-04-10T12:30:54","modified_gmt":"2023-04-10T16:30:54","slug":"problem-globalsign-certificates","status":"publish","type":"post","link":"https:\/\/www.thesslstore.com\/blog\/problem-globalsign-certificates\/","title":{"rendered":"GlobalSign Certificate Problems Accidentally Block Sites"},"content":{"rendered":"

Unexpected error causes browsers to report certificates as revoked.<\/h2>\n

Websites secured with GlobalSign had a bad day yesterday when a mishap with the CA\u2019s OCSP service caused browsers to treat their certificates as if they had been revoked.<\/p>\n

The Register originally reported on the issue<\/a>, which was widespread, and affected sites including Wikipedia, Logmein, The Guardian, and Dropbox.<\/p>\n

This prevented many users from reaching the affected sites, as their browsers believed the certificates to be revoked and blocked access. Reports of problems came from all across the globe, but outages were inconsistent. Some users did not have any problem at all.<\/p>\n

OCSP, which stands for Online Certificate Status Protocol, is a revocation mechanism that clients (like your browser) use to check if an SSL certificate has been revoked by the Certificate Authority who issued it. When a certificate is revoked, browsers prevent connections being made with said certificate, because of possible security risks. OCSP works by querying the CAs server and getting a confirmation that the certificate is \u201cgood\u201d or \u201crevoked.\u201d<\/p>\n<\/span>\n

All CAs operate their own OCSP service. Yesterday GlobalSign\u2019s service started reporting widespread revocations as a result of a planned action to revoke one of their intermediate certificates.<\/p>\n

GlobalSign explained the problem in an official statement<\/a>:<\/p>\n

\u201cGlobalSign manages several root certificates and for compatibility and browser ubiquity reasons provides several cross-certificates between those roots to maximize the effectiveness across a variety of platforms.\u00a0 As part of a planned exercise to remove some of those links, a cross-certificate linking two roots together was revoked.\u00a0 CRL responses had been operational for 1 week, however an unexpected consequence of providing OCSP responses became apparent this morning, in that some browsers incorrectly inferred that the cross-signed root had revoked intermediates, which was not the case.\u201d<\/p><\/blockquote>\n

OCSP is a delicate technology \u2013 because it relies on getting a live response from the CA’s server, it needs to have extremely high availability and speed. Otherwise, the OCSP check can add significant time to the SSL handshake which in turn delays the loading of the website.<\/p>\n

Many CAs contract with a CDN (Content Delivery Network) to ensure that these conditions are met. In this case, CDNs were the cause of the problem. While GlobalSign quickly fixed the issue at its source \u2013 by removing the affected intermediate certificate from its OCSP database \u2013 that information was not reaching end users because CDNs were caching the previous information and still reporting that they were revoked.<\/p>\n

For some end users, caching will cause this problem to persist for a few more days and into the weekend, so Globalsign has issued new intermediate certificates that won\u2019t be affected. Sites using GlobalSign certificates can replace their current intermediate certs with these to sort out their revocation issues.<\/p>\n

If you are a GlobalSign customer who was affected, the company has posted a troubleshooting guide<\/a> that will help you resolve the issues. GlobalSign\u2019s Status page<\/a> reports any known problems or upcoming maintenance and it posts regular incident updates on its\u00a0Twitter account<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"

Unexpected error causes browsers to report certificates as revoked. Websites secured with GlobalSign had a bad day yesterday when a mishap with the CA\u2019s OCSP service caused browsers to treat…<\/p>\n","protected":false},"author":2,"featured_media":3121,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":"","tve_updated_post":"","tve_custom_css":"","tve_user_custom_css":"","tve_globals":{},"tcb2_ready":0,"tcb_editor_enabled":0,"tve_landing_page":"","_tve_header":"","_tve_footer":""},"categories":[17],"tags":[238,239,163,136],"class_list":["post-3119","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-industry-lowdown","tag-globalsign","tag-ocsp","tag-revocation","tag-ssl","post-with-tags"],"views":13110,"jetpack_featured_media_url":"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2016\/10\/iStock_84677177_SMALL.jpg","_links":{"self":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/3119","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/comments?post=3119"}],"version-history":[{"count":0,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/3119\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media\/3121"}],"wp:attachment":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media?parent=3119"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/categories?post=3119"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/tags?post=3119"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}