On 26 Jun 2017 20:45, "Greg Newby" <[1]gbnewby@pglaf.org> wrote:
   >
   > On Mon, Jun 26, 2017 at 10:26:08AM -0300, Ben Mezger wrote:
   > > This *only* happens on Google Chrome and Chromium.
   > >
   > > Any idea why this might happen?
   >
   > I'll get this fixed over the next day or so, probably with a
   letsencrypt cert.  Details:
   >
   > I'm running the current incarnation of [2]https://lists.cpunks.org
   and this problem was presumably caused by some SSL changes I made
   yesterday.
   >
   > The [3]lists.cpunks.org Apache named virtual host lives on
   [4]mail.pglaf.org, which uses a wildcard certificate for *.[5]pglaf.org
   duly issued by Network Solutions.
   >
   > So, Chrome is right to complain that the cert doesn't match the
   domain.  See, for example:
   [6]https://www.ssllabs.com/ssltest/analyze.html?d=lists.cpunks.org
   >

   Thats not what its complaining about. It's saying the cert issuer isn't
   trusted (though without SNI you will get the wildcard which doesn't
   match).

   If you expand the certification paths you'll see Startcom is marked as
   self-signed. Afaik it has been ever since they got caught issuing
   [7]google.com certs and the like for "testing".

   This has been on the horizon for a while, and similar is going to start
   happening for some certificates issued by Symantec CAs soon too.

   > It's interesting that this new error didn't occur until I tightened
   the cipher suites.  In apache2.conf, the old set was:
   >
   >     SSLCipherSuite
   ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP
   >

   It's interesting timing, but I suspect may simply be coincidence.

   > ... which yielded some recent reports of Firefox complaining about
   allowing SSL3 and some other less secure ciphers.
   >
   > The current config line, as of Sunday afternoon, is:
   >     SSLCipherSuite
   ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:-MEDIUM:-LOW:-SSLv2:-SSLv3:+EXP
   >
   >   - Greg
   >

References

   1. mailto:gbnewby@pglaf.org
   2. https://lists.cpunks.org/
   3. http://lists.cpunks.org/
   4. http://mail.pglaf.org/
   5. http://pglaf.org/
   6. https://www.ssllabs.com/ssltest/analyze.html?d=lists.cpunks.org
   7. http://google.com/