3

I did some security updates yesterday.

Note sure if it is related, but now Chromium is unable to load amazon web page. Other wesites work fine and amazon under Firefox works well.

Tried to clear cache from Chromium, also uninstalled and reinstalled Chromium from the software manager with no success.

See how the page looks like: enter image description here

What could be wrong?

My OS info:

Distributor ID: LinuxMint
Description:    Linux Mint 17.3 Rosa
Release:    17.3
Codename:   rosa
4
  • What version of ubuntu are you using? Nov 14 '16 at 18:27
  • @ElijahCruzWebservices: Updated the post
    – jpo38
    Nov 14 '16 at 18:40
  • Mint is off topic here. As are bug reports. There is a coming update in Ubuntu that should resolve the issue, as I understand.
    – dobey
    Nov 14 '16 at 19:29
  • Hi folks! Last chromium update proposed today by Mint solved the problem!
    – jpo38
    Nov 22 '16 at 21:49
5

Because Chromium distrust a Symantec intermediate CA and a GeoTrust intermediate CA. According to launchpad, this seems to be a bug of Chromium.
In particular, some posts in launchpad point out that this phenomenon is because the current Chromium build in Ubuntu repository is more than 10 weeks old, so Chromium suspects its security info might be out of date, and therefore switch to a stricter security policy.


Solutions:

  • "Correct" solution: Wait until the next Chromium patch.
  • "Incorrect" solution for experts: Force Chromium to trust this Symantec root certificate.
    In this page, copy the certificate (the text with grey background) and save it as any file, then open Chromium Setting > Manage certificates... > Authorities import the certificate you just saved, remember to check Trust this certificate for identifying websites.
  • Workaround solution (DNS): The affected CAs are widely used in CDNs, but the originating server might be verified by an unaffected CA. Thus if you use Google DNS (8.8.8.8), you would connect to the originating server whose certificate might be unaffected.
  • Temporal solution: Assume you just want to view some insensitive websites. Then you can ask Chromium to ignore these issues. E.g. if you want to read NY Times www.nytimes.com, open https://static01.nyt.com and https://a1.nyt.com. In the warning page, click "ADVANCED" and then click "Proceed to ... (unsafe)".
    This enforces Chrome / Chromium to ignore this privacy alert on NY Times website, so that you can keep surfing.
    enter image description here Warning: Unless you understand what's happening, don't use the same trick on sensitive websites like your bank.

Diagnosis:

Right click any image in NY Times homepage and choose "Open image in new tab" NYtimes

In the new tab, Chrome / Chromium told you that he reject to download the picture due to private concern. Click the grey text for more detail. enter image description here

This website (static01.nyt.com in particular) is verified via a root certificate issued by Symantec CA, which is no more trusted by Chrome / Chromium. enter image description here

5
0

It looks to be DNS related, at least on my machine. I have changed my /etc/resolv.covf (temporary under ubuntu, read more on resolv.conf head to get the perm entry) and added the google DNS server as primary.

It now draws amazon.com correctly for me.

I consider this workaround only, since any dns should normally work with it.. not specific ones only. I just don't have time to run this one down for now..

(also, I note that it flips repeatedly and quickly through "establishing secure connection" messages on the status bar when it is not working correctly. I am assuming that the issue is related to the certs.)

1
  • See Tianren Liu's comment. If this is the case, then it is definitely cert related. Looks like this one will work itself out in a bit when Amazon updates certs. Nov 14 '16 at 19:32

Not the answer you're looking for? Browse other questions tagged or ask your own question.