Why do I have untrusted certificates for Google, Yahoo, Mozilla and others?

Question

In the HTTPS/SSL section of chrome://chrome/settings, I see the following: What does this mean, and is there something wrong?

I have a basic understanding of SSL/TLS - I'm not claiming to be completely familiar, but I'm fairly confident I know my way around it - but I don't understand why I have certificates installed on my machine specifically for these sites.

From my understanding, I should have the certificates for Certificate Authorities, and any site I visit and use SSL/TLS should have a certificate signed by one of these trusted CAs for me to trust the site.

My worry is that if someone has maliciously installed a certificate for these sites on my machine, they could perform a DNS spoofing attack (or a number of other attacks) to hijack my connection to my email account without me knowing, and as they've got the private counterpart to the certificate on my machine, decrypt the communication.

NB: I'm also aware that CA certificates aren't just within Chromium and are used system wide as part of libssl - they're stored in /etc/ssl/certs.

What I'd like to know is:

• Is this correct? - The big red boxes make me think no
• Is this malicious or benign?
• What can I do to resolve this problem? (If indeed it is a problem)

Thanks :)

Solution

This is a good thing. Those certificates were revoked, often because someone applied for/acquired a certificate (private key) for an entity they don't own, which can be used for impersonation. The revoked certificate list on your system basically tells your system not to trust these certificates.

Certificates are often used to identify the website, which relies on the issuer not issuing it to someone else. Those certificates in your screenshot were listed as fraudulent or untrusted because the issuer made a mistake and must tell everyone not to trust the certificate they already signed. Occasionally, the group that created the trusted list (e.g. your OS/browser developers) may manually add certificates to the untrusted list, possibly if the issuer takes too long to do so.

See for more info: Public key certificate and Revocation lists

Comments

[Paul]

If you check the CA for each cert, you can check in the Authorities tab to see if you have matching CA cert. Addons.mozilla.org should be Verisign, it is weird how it is listed under Google Ltd

[Canadian Luke]

What is your clock set at?

[jackweirdy]

Thanks! I've heard of revocation lists and expiry before but I guess I didn't put 2+2 together :)

[tvdo]

@jackweirdy You also appear to be looking at the servers list, which would only list server specific certificates - i.e. those you manually add as (un)trusted, or those on a CRL. The authorities list (in the other tab) probably lists root and intermediate CAs. Most sites would use a certificate from a common CA, rather than requiring users to manually add a certificate to their trusted list. I'm not sure about Chrome, but when a certificate cannot be validated in FF I have the option of temporarily accepting it or permanently adding an 'exception', which means adding it to a trusted list.

[jackweirdy]

I understood the concept of CAs; I was just surprised to see entries for specific servers :) Chrome & Chromium warn you that the certificate is invalid/self signed and let you decide what to do :)