SSL certificate untrusted

Was looking to book a holiday on a website ive used for years to book stuff on, and went to login to my account. On Firefox and IE it went to the secure site no problems and the connection/certificate was verified. However on my phone the same website throws a warning both on the stock Android browser and on Chrome saying the servers certificate cannot be trusted.

I put the website into an SSL checker and it comes back

The certificate is not trusted in all web browsers. You may need to install an Intermediate/chain certificate to link it to a trusted root certificate

Anyone know what that means? Ive emailed the webmaster of the site, but i assume its just a misconfigured certificate rather than anything dodgy going on

The website is http://www.exodus.co.uk/ and you can get to the secure bit by clicking "Sign in/register" at the top. Strange how Firefox on my PC doesnt throw this error up

They've misconfiigured their server. It should send your browser three security certificates but it only sends two. Firefox indicates that the site is not secure by not having a padlock symbol.

Padlock symbol is there in Firefox and the address bar is green which is what is confusing me

Firefox will already have those intermediate certificates so does not need them from the server.

https://www.sslshopper.com/ssl-checker.html#hostname... is a good site to visually show the broken chain.

Matt

Edited by uno (Mon 04-Apr-16 14:18:14)

Yea cheers used a few sites to check and all said an untrusted chain certificate. So is the site secure to use even with these warnings? Or in the case of Firefox no warning?

Yes. Even though the chain is broken for some browsers, others that already know the chain can confirm it is safe.

The data to/from the end host will still be encrypted.

Matt

Cheers thanks for the reassurance

Wack the url into here, the de facto ssl test site on the Internet:

https://www.ssllabs.com/ssltest/

It will give you a very detailed report of the site.

Nick

Gets a B rating but due to

This server's certificate chain is incomplete. Grade capped to B.

In reply to a post by bobble_bob:

Padlock symbol is there in Firefox and the address bar is green which is what is confusing me

It's there for a fraction of a second on Firefox 38.7.1 ESR on a Mac and then it disappears and comes up with the warning symbol. I haven't actually tried it on a Windoze box.