4

A client of ours has a website that works on most browsers. However, when trying to open it in Chrome (114), Edge (114) or Samsung Internet (21) on Android, there is an error message saying

Your connection is not private ERR:ERR_CERT_AUTHORITY_INVALID.

We tried several phones with Android 12 and 13, but the results are all the same.

Also:

  • Firefox on Android works
  • Chrome and Safari on iPad and iPhone work
  • Chrome, Edge and Firefox on Windows desktop work

Because it works in almost all browsers, I think it's safe to assume there is nothing wrong with the certificate, and the problem lies with Chromium.

My question is, how can I further investigate this issue?

(I realize this question may not necessarily be about Android, but I'm not sure where else to post it)

Improve this question

1 Answer 1

Reset to default
4

In my experience, recent versions of Chrome for Android now require certificates that are issued by a root CA which participates in the certificate transparency program.

This program records all issued certificates by a CA in a public log (you can see this log in real-time e.g. on certstream.calidog.io, scroll down on this page and click the OPEN THE FIREHOSE button). Therefore, if a CA is (or becomes) malicious and issues a certificate for www.google.com but the CA has no relation to Google, this will be recorded in the certificate transparency list and Google would see this malpractice. In the end, the CA would be banned from the trusted root CA lists in common browsers and OS.

Improve this answer
3
  • Interesting. Is there a quick way to check if a certain (root) certificate is in that program? I noticed that our client has a cert from a different root CA on another subdomain, and that one does work everywhere
    – Berend
    Jul 6 at 9:39
  • @Berend Looking e.g. at the certificate of www.google.com using KeyStore Explorer I can see a certificate extension with the OID 1.3.6.1.4.1.11129.2.4.2 "Certificate Transparency SCTs". I don't know the spec, but I would assume that every certificate issued by a certificate transparency aware CA contains such an extension.
    – Robert
    Jul 6 at 9:50
  • I don't see that particular extension, so maybe Chromium has other requirements as well. At least I have a clearer picture now, so thanks. I'll investigate further.
    – Berend
    Jul 6 at 11:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .