On another subject I think the way chrome is programmed to handle the issue is quite bad now.

It displays a vague "not secure" message when in the past it would actually tell you whats wrong e.g. a weak cipher, as well as the cipher in use. Yet it doesnt blurt on about plain http been "not secure". So in that respect its misleading.

For one to actually get the information required from chrome now you have to open the developer tools which is pretty ridiculous just to see the cipher details and certificate.

In reply to a post by RobertoS:

Don't use google search. Simply favourite/bookmark the one that works.

Alternatively, come back to this post and click this link.

Don't take this the wrong way of anything.

Maybe its just the inner Software / Hardware Developer in me talking here or maybe my OCD, but that still doesn't resolve the fact that the SSL side of that site is insecure and that the server has loads of bad security holes in it that really need to be fixed.

And burying your head in the sand by using the non SSL version (i.e. HTTP) of the checker isn't resolving anything apart from stopping the "Not secure" from being displayed.

The SSL side of that site was so that we can enter our information in securely without the man in the middle peeking at our information.

Anyway that's my rant over on this subject.

Paul

TBH I have never liked Chrome, but due to what I do I have to cater for it

Paul

Not a problem Paul.

My concern is not for the BT Wholesale server as a whole, but simply for the continuing availability of this facility to the public.

It is hugely important to the central purposes of this site that it continues.

By hammering BT in the way that has been suggested in this thread, including the possibility of attacking the server and bringing it down, the danger of the facility being simply withdrawn becomes extremely high.

I wish everyone would simply desist. I'm sure the messages to BT that posters here have sent will have been noted. As has been posted a few times, when the certificate is renewed in the near future the issue should be resolved.

In reply to a post by PaulKirby:

I just checked the command line args and its no longer has the hash signing args there, the rsa key size args are still there which it should be.

So maybe they realised they hadn't updated it and now its changed.

The issuer of my CERTS are Authority X3 level and its issuer is listed as CA X3.

It was either end of 2015 or start / mid 2016 that I got my first CERT.

Let's Encrypt, the issuer you're talking about, literally hasn't ever offered SHA1 certificates. So, your memory is playing tricks on you. But thanks for checking.

In reply to a post by RobertoS:

when the certificate is renewed in the near future the issue should be resolved.

Well that would be a huge part resolved, but the server would still need to have all the security patches installed to close up all the holes and some tweaks to the Protocols used (disable SSL3, Enable TLS1.1, TLS1.2) and tweak the Cipher Suits to the changed Protocols and that's it.

If BT don't at least do the tweaks the secure side of things would just stop working due to TLS1.0 is just for testing stuff now days and is due to be retired and the server should really be using TLS1.2 first, then fall back to TLS1.1 and then just return back that it has failed to pick a protocol.

BTW all these tweaks only require editing a config file and that's it, plugging the holes would require stuff being installed, but if the tweaks are done it might remove the need to do most of the patches due to the software with the holes are disabled.

But at least the info we send would be securely encrypted.

As for the site to continue, I also wish this, that's why I have only contacted BT the once via twitter.
I was hoping that would of gotten the ball rolling, maybe it has but they have other stuff to do first and where the CERT is due for renewal they might of decided to do it all then.

Paul

In reply to a post by tialaramex:

Let's Encrypt, the issuer you're talking about, literally hasn't ever offered SHA1 certificates. So, your memory is playing tricks on you. But thanks for checking.

Yeah, its possible, I did try loads of CA's over the years before ending up with Let's Encrypt.

So I might of seen somewhere SHA1 being used by one of the others along with their huge prices.

Paul

I knew I remembered this thread. Glad I found it again..

I was just going to run a dsl number check and got the same issue as you guys. Insecure Connection warning. It's on FF, Chrome and Opera.

This thread as been going for a few weeks and still no change. A tech company that BT/OR is supposed to be, they really need to be leading the industry, not lagging behind.. smh

I think people are using a link that they aren't supposed to be using:

All requests for the HTML version of the availability checker should be made to:
http://www.dslchecker.bt.com/adsl/adslchecker.welcome

That worked!

I entered in to google bt dsl checker and the address https://www.dslchecker.bt.com/ comes up. I guess thats a site root page or something.