Exchange Coverage Map

Previously I have seen a coverage map for the BT exchanges however in recent times I've not been able to find it. I believe it may have been on Samknows.

Any idea where I can find one now?

Just want to see the footprint covered by my local exchange

You need the FTTP rollout map from Openreach. Someone more helpful will be along in a minute to give the exact URL, I don't seem to have bookmarked it. If you're searching, its the recent exchange area dateline for FTTP. Is clearly shows exchange coverage areas.

If its on this page (it says it is) I can't see it. https://www.openreach.com/fibre-broadband/where-when...

Thanks mate that’s perfect

Can you see the map on the page I linked to? I can't. I thiught it was because Iwas on an iPad but I don't see it on my Mac either. I've even disabled all the ad and cookie blocks...

Perhaps because of certificate probs on the site, I see - "An error occurred during a connection to api.superfastmaps.co.uk. Peer’s Certificate has been revoked." where the map should be although the rest of the page loads.

I'm getting the same cert error. This page was working for me just before Christmas, so poss. the cert expired at the end of 2021, even though the error says revoked.

Ah, yes, I see that now. Thanks, glad it not just me!

In reply to a post by Woolwich:

Can you see the map on the page I linked to? I can't. I thiught it was because Iwas on an iPad but I don't see it on my Mac either. I've even disabled all the ad and cookie blocks...

I just went to that link and Openreach map working fine for me.

Yes I'm getting the same. "Website certificate revoked".
In my case it seems it's Eset which has blocked it. So that might be my security software doing it.

Surprised Openreach aren't right on to this.

Are you able to see the map via below link

https://api.superfastmaps.co.uk/fibrecities/2.0/

In reply to a post by Woolwich:

Can you see the map on the page I linked to? I can't. I thiught it was because Iwas on an iPad but I don't see it on my Mac either. I've even disabled all the ad and cookie blocks...

Yes works fine thanks for your help

Certificate issue on that one as well.

Strange working OK for me.

Secure Connection Failed

An error occurred during a connection to api.superfastmaps.co.uk. Peer’s Certificate has been revoked.

Error code: SEC_ERROR_REVOKED_CERTIFICATE

The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
Please contact the web site owners to inform them of this problem.

In reply to a post by MHC:

Secure Connection Failed

An error occurred during a connection to api.superfastmaps.co.uk. Peer’s Certificate has been revoked.

Error code: SEC_ERROR_REVOKED_CERTIFICATE

The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
Please contact the web site owners to inform them of this problem.

I am sure their must be a reason why its working for some and not others but I have't got a foggy why it would be.

Exact same message appears on te OR page linked to by Woolwich ...

Could it be down to which browser is in use, in my case Firefox (latest version 95.0.2 64 bit).

In reply to a post by MHC:

Exact same message appears on te OR page linked to by Woolwich ...

I just checked the link on my mobile (both Wifi and 4G) and that works too

In reply to a post by longedge:

Could it be down to which browser is in use, in my case Firefox (latest version 95.0.2 64 bit).

Maybe but my PC and Mobile have nothing in common and both working.

I've just tried three browsers - Google Chrome, Firefox, and Brave. All block access.
The Brave browser actually gave half a page of reasons why it has done this.
The Chrome and Firefox browsers both display messages from Eset.

My guess is the anti virus / security software in use is doing this.

In reply to a post by dect:

I am sure their must be a reason why its working for some and not others but I have't got a foggy why it would be.

I'm assuming Apple users aren't seeing the site because Safari is strict about letting you view dodgy sites, in this case one where the certificate has been revoked.

It isn't down to AV/security software, the certificate does appear to have been revoked https://www.ssllabs.com/ssltest/analyze.html?d=https...

In reply to a post by Woolwich:

In reply to a post by dect:

I am sure their must be a reason why its working for some and not others but I have't got a foggy why it would be.

I'm assuming Apple users aren't seeing the site because Safari is strict about letting you view dodgy sites, in this case one where the certificate has been revoked.

You're almost certainly correct. Using my iPad the first link gave the site but no map. The second gave the long explanation about the peer's certificate revoked.

Using my laptop, on Chrome in Windows no problem.

Edited by pluralist (Sat 08-Jan-22 16:47:35)

In reply to a post by pluralist:

You're almost certainly correct. Using my iPad the first link gave the site but no map. The second gave the long explanation about the peer's certificate revoked.

Using my laptop, on Chrome in Windows no problem.

Managed to get the certificate issue on an old version of Internet Explorer, it does raise the question why Chrome and the latest version of Edge doesn't highlight it as well.

In reply to a post by clyde123:

Surprised Openreach aren't right on to this.

They're quite probably blissfully unaware...expect virtually all of their corporate and back-office staff are on Windows-based builds.

[bit of a first world problem, but possibly need to ping them a note that won't get buried or ignored].

everything seems to be working fine on PC's my end Checked on windows 11, macs however do have an issue in safari, certificate issue, PC says secure mac not so much.

Has anyone sent an email over to the OR team to let them know of the problem.

Fails in Firefox, Safari, on any platform. Works in Chrome, Edge on any platform.

What worries me is why it works in Chrome & Edge, when the cert has been revoked. Implies the Chromium code base they both rely on is not checking for certificate revocation, which means both the browsers are flawed in their security handling. Ugh!

In reply to a post by jchamier:

Fails in Firefox, Safari, on any platform. Works in Chrome, Edge on any platform.

What worries me is why it works in Chrome & Edge, when the cert has been revoked. Implies the Chromium code base they both rely on is not checking for certificate revocation, which means both the browsers are flawed in their security handling. Ugh!

Ugh indeed!

Edit: That's with the latest Chrome update 97.0.4692.71. Supposed to fix 37 serious bugs including many Use-After-Free (UAF) bugs that hackers have apparently been exploiting.

Edited by pluralist (Sat 08-Jan-22 18:43:36)

In reply to a post by RR_The_IT_Guy:

everything seems to be working fine on PC's my end Checked on windows 11, macs however do have an issue in safari, certificate issue, PC says secure mac not so much.

Has anyone sent an email over to the OR team to let them know of the problem.

As above - I would not describe it as an “issue in safari”. It’s the exact opposite - an actual security issue in chrome and edge - which aren’t flagging the revoked certificate.

Though a sense of proportionality of the “issue” is required, at least in this specific instance. The issue is of a wider security flaw in those browsers that could lead to an exploit. Just happens that it’s a revoked certificate on the Openreach main site.

Edited by Pheasant (Sat 08-Jan-22 19:31:17)

In reply to a post by Pheasant:

which aren’t flagging the revoked certificate.

Openreach are using sectigo for this cert, whom don't have the best reputation, formerly Comodo they renamed themselves after the brand was tarnished due to the CA not issuing certificates in accordance with their own procedures. Hence the likes of Mozilla, Apple and Microsoft took action to block many of their certs.

Sectigo have a page on their site that says what to "do" if you hit this problem, which mostly reinstalls various Windows DLLs that are used by IE (??) and tells you to clear the cache in Firefox and other browsers.

Why Openreach are using Sectigo for the map and Digicert for the main site is very strange, you typically have one CA provider. My guess is the map is outsourced to a third party whom have foolishly used Sectigo.

For example, one thread of issues getting Sectigo to respond to problematic certs:
https://bugzilla.mozilla.org/show_bug.cgi?id=1639805

Edited by jchamier (Sat 08-Jan-22 19:45:02)

Ah turns out it was working on my chrome, edge, firefox.

After some investigation my end it seems that I have a load of disabled security settings for firefox as a long time ago i used firefox to access an internal site that was secure 50% of the time depending what computer was being used and depending how many times I would reboot the web server, it was the only way to access it.

Since the internal site is no longer exists I have reset firefox to default and it now no longer access the site.

I will admit I haven't used firefox that much recently, mainly the two RAM suckers (unfortunately the reason i moved to this was due to an extension i needed (only on chrome or chromium based browsers)

In reply to a post by jchamier:

My guess is the map is outsourced to a third party whom have foolishly used Sectigo.

Indeed.

In short, it’s because checking certificate revocation is slow and relatively expensive: maximum security means blocking the connection until the check is complete.

https://www.ssl.com/blogs/how-do-browsers-handle-rev...

You can enable OCSP and CRL in most browser configurations, but many are off by default to make the browser feel more responsive when making new TLS connections.

In reply to a post by DougM:

In short, it’s because checking certificate revocation is slow and relatively expensive: maximum security means blocking the connection until the check is complete.

https://www.ssl.com/blogs/how-do-browsers-handle-rev...

You can enable OCSP and CRL in most browser configurations, but many are off by default to make the browser feel more responsive when making new TLS connections.

Firefox does this and still feels faster than chrome.

In The latest version of Edge I typed 'edge://components' in the browser and for 'CRLSet' I pressed 'Check for Updates' and although it said 'No update available' I am now getting the revoke message although this maybe a coincidence as I tried in on another device and am not getting the revoke message.