Še komu ne gre na podnapisi.net?

Še komu ne gre na podnapisi.net?

Tudi meni ne

Zakaj meni podnapisi.net deluje ko se pa prijavim pa ne deluje več.

meni dela sem preveril

Se dogaja samo meni, ali stran ne deluje?
Že teden dni nisem uspel priti na stran...

zila90 je 12. nov 2023 ob 07:07 izjavil:

Meni ne dela. Brskalnik mi vedno javlja, da spletno mesto ne more zagotoviti varne povezave (ERR_SSL_PROTOCOL_ERROR).
Lahko kako zaobidem to napako?

Poskusi s tem:
https://duckduckgo.com/?q=podnapisi+net...

Ni kriv samo Chrome, tudi na Operi ne dela, deluje pa z Mozillo Firefox. Zgleda da je težava na podnapisi.net in ne Chrome in Opera. Ali se motim?

Raziskujem problem.

Na FF dela, vidim da stran tam uporablja sledeče:

FF @ podnapisi.net, klik na ključavnico, connection secure, more information, view certificate

1. podnapisi.net
[Subject Name]
Common Name: podnapisi.net

[Issuer Name]
Country: US
Organization: Let's Encrypt
Common Name: R3

[Validity]
Not Before
Tue, 31 Oct 2023 17:03:01 GMT
Not After
Mon, 29 Jan 2024 17:03:00 GMT


2. R3
[Subject Name]
Country: US
Organization: Let's Encrypt
Common Name: R3

[Issuer Name]
Country: US
Organization: Internet Security Research Group
Common Name: ISRG Root X1

[Validity]
Not Before Fri, 04 Sep 2020 00:00:00 GMT
Not After Mon, 15 Sep 2025 16:00:00 GMT

[Public Key Info]
Algorithm: RSA
Key Size: 2048
Exponent: 65537
Modulus:BB:02:15:28:CC:F6:A0:94:D3:0F:12:EC:8D:55:92:C3:F8:82:F1:99:A6:7A:42:88:A7:5D:2 ...


ter
3. ISRG Root X1

[Subject Name]
Country: US
Organization: Internet Security Research Group
Common Name: ISRG Root X1

[Issuer Name]
Country: US
Organization: Internet Security Research Group
Common Name: ISRG Root X1

Not Before Thu, 04 Jun 2015 11:04:38 GMT
Not After Mon, 04 Jun 2035 11:04:38 GMT

Algorithm: RSA
Key Size: 2048
Exponent: 65537
Modulus: AD:E8:24:73:F4:14:37:F3:9B:9E:2B:57:28:1C:87:BE:DC:B7:DF:38:90:8C:6E:3C:E6:57:A0...


in če gledam tu ssllabs
https://www.ssllabs.com/ssltest/analyze...
se vidi da FF (isto Palemoon portable 32.x) uporabljata

SS iz Palemoon


prva izbira
Server Key and Certificate #1
Valid from Tue, 31 Oct 2023 17:03:01 UTC
Valid until Mon, 29 Jan 2024 17:03:00 UTC (expires in 2 months and 14 days)
Key RSA 4096 bits (e 65537)


druga izbira
Additional Certificates (if supplied)
#2
Subject R3
Valid until Mon, 15 Sep 2025 16:00:00 UTC (expires in 1 year and 10 months)
Key RSA 2048 bits (e 65537)
Issuer ISRG Root X1


tretja izbira
#3
ne more uporabljati nihče več, kajti DST Root CA X3 je potekel 09/2021 https://letsencrypt.org/docs/dst-root-c...



letsencrypt certifikati so na voljo tu:
https://letsencrypt.org/certificates/




Chrome uporablja sistemsko (OS) windows "bazo" certifikatov (trusted root certification authorities, intermediate certification authorities, in ostali tabi), tam vidim da je taisti certifikat (ISRG Root X1) že notri

https://woshub.com/updating-trusted-roo...
Managing Trusted Root Certificates in Windows 10 and 11
How to see the list of trusted root certificates on a Windows computer?

1 To open the root certificate store of a computer running Windows 11/10/8.1/7 or Windows Server 2022/2019/2016, run the mmc.exe console;
2 Select File -> Add/Remove Snap-in, select Certificates (certmgr) in the list of snap-ins -> Add;
3 Select that you want to manage certificates of local Computer account;
4 Next -> OK -> OK;
5 Expand the Certificates node -> Trusted Root Certification Authorities Store. This section contains the list of trusted root certificates on your computer.

bližnjica: start, run , certlm.msc


v "trusted root certification authorities" imam ISRG Root X1 4.6.2035
v "intermediate certification authorities" imam R3 (Let's Encrypt 15.9.2025

a še vedno na Chromu ne dela.

Windows 7 x32, chromium woolyss 109 (novejši ne delajo), stran se lepo odpre, uporablja Server Key and Certificate #1, tako kot FF in PM.

Kje se da izklopiti ta preload pages v android telefonu na chromu?

Nekdaj stvari za preveriti
https://www.maketecheasier.com/fix-err-...
https://sectigostore.com/blog/how-to-fi...

Update1
Na linux (porteous) 5.01 xfce in chromium ungoogled 119 stran NE dela.



Rešitev
Update2
chrome://flags

Allow sha-1 server signatures in TLS

Iz default na enabled.

Imho morajo na podnapisi.net odstraniti to legacy funkcijo, drugače se bo zgodba z verzijo 123 ponovila.


Za FF ne najdem, kdaj bodo ukinili support za sha-1 server TLS handshake.

Našel samo stare članke iz 2016, kjer so to naredili in potem restorali nazaj
https://www.zdnet.com/article/firefox-b...
https://www.eweek.com/enterprise-apps/m...

Konec zabave, tudi flag sha-1 enabled/disabled/default ne pomaga več.

chromium 119.0.6045.160
stran odpre, a napiše samo:
Internal Server Error

ali
502 Bad Gateway



medtem v FF 120 odpre kot mora (dejanska stran).

V https://duckduckgo.com/ jo odpre , v FF ne. Trenutno.

sbawe64 je 3. dec 2023 ob 20:33 izjavil:

Konec zabave, tudi flag sha-1 enabled/disabled/default ne pomaga več.

chromium 119.0.6045.160
stran odpre, a napiše samo:
Internal Server Error

ali
502 Bad Gateway



medtem v FF 120 odpre kot mora (dejanska stran).

Update
na chromium 120.0.6099.71 sedaj stran odpre .

Stran še vedno uporablja sha-1 za server signature.