How to resolve SSL error when access website which is using Hong Kong Post CA issued SSL cert?

When using Google Chrome to access, there are error message: "NET::ERR_CERT_AUTHORITY_INVALD"

Missing Cert on client machine:

Download:

https://www.digitalpolicy.gov.hk/en/our_work/digital_infrastructure/legal_framework/regulation/eto/doc/hk_post_root_3.zip

https://www.digitalpolicy.gov.hk/en/our_work/digital_infrastructure/legal_framework/regulation/eto/doc/hk_post_root_3_cross_signed_by_globalsign_car3.zip

https://www.digitalpolicy.gov.hk/en/our_work/digital_infrastructure/legal_framework/regulation/eto/doc/hk_post_e-cert_ssl_3-17.zip

You can use www.ssllab.com to check the website SSL cert's cert path to see any SSL cert is missing on your laptop.

Reference:

有關郵政署署長的披露紀錄-頁1 | 數字政策辦公室

How to resolve SSL error when access website which is using Hong Kong Post CA issued SSL cert?

Cisco ASA SSL certificate expired - Cisco Anyconnect error message

"AnyConnect cannot confirm it is connected to your secure gateway. The local network may not be trustworthy. Please try another network"

How to verify Cisco ASA SSL certificate expire or not?

Open browser to enter the URL of Cisco anyconnect to check the cert status

Cisco ASA SSL certificate expired - Cisco Anyconnect error message

Cisco VPN error - Anyconnect cannot confirm it is connected to your secure gateway. The local network may not be trustworthy. Please try another network

Possible reason: The Cisco ASA SSL certificate issue on the VPN profile and/or Interface

Solution: Fix the SSL certificate issue

Cisco VPN error - Anyconnect cannot confirm it is connected to your secure gateway. The local network may not be trustworthy. Please try another network

H3C Firewall Change admin portal certificate

1. Go to H3C Firewall -> SSL -> SSL Server Policies to create a new Policy e.g. "abc_2024-2026"

2. Create a PKI Domain for new cert installation

3. Go to PKI -> Certificate -> Import 2 CA cert and 1 local cert

CA to provide TWO CA cert (.cer) (When install second CA, just ignore the cert will be replace warning) and One local cert (.pfx) (RSA 2048) (This local cert need to includ private key and also ignore the cert will be replace warning)

4. SSH to the firewall 

 > show current-configuration (Enable logging on putty before run this command) 

 > system-view ] undo ip https enable 

 ] ip https ssl-server-policy <New Policy Name which is you create at step1> 

 ] ip https enable 

 ] save force 

 ] exit 

 >

H3C Firewall Change admin portal certificate

Fortinet SSL VPN - SSL Certificate expired and you need to bypass tempoarilty

Configure SSL VPN to Not Require Certificates

Go to VPN > SSL > Settings > and un-check Require Client Certificate.

Fortinet SSL VPN - SSL Certificate expired and you need to bypass tempoarilty

Google Chrome cannot access any https:\\ website and the return error is "Your connection is not private" (NET:ERR_CERT_WEAK_SIGNATURE_ALGORITHM)

Problem:

Google Chrome cannot access any https:\\ website and the return error is "Your connection is not private" (NET:ERR_CERT_WEAK_SIGNATURE_ALGORITHM)

Affected Users:

Users who is new install Google Chrome v.56 or above (Existing user who have chrome installed and upgrade to v.56 or above did not affected)

 

Reason:

Proxy CA certificate still using SHA-1, it cause Google Chrome did not allow all https:\\ website access due to it remove support for SHA-1 certificate.

Workaround Solution:

Create a registry key:
EnableSha1ForLocalAnchors and Value = 1
Whether SHA-1 signed certificates issued by local trust anchors are allowed
Data type:
Boolean [Windows:REG_DWORD]
Windows registry location:
HKLM\Software\Policies\Google\Chrome\EnableSha1ForLocalAnchors

 

Remark:
When this setting is enabled, Google Chrome allows SHA-1 signed certificates as long as they successfully validate and chain to a locally-installed CA certificates.

Note that this policy depends on the operating system certificate verification stack allowing SHA-1 signatures. If an OS update changes the OS handling of SHA-1 certificates, this policy may no longer have effect. Further, this policy is intended as a temporary workaround to give enterprises more time to move away from SHA-1. This policy will be removed on or around January 1st 2019.

 

Issue fixed:

 

Reference:
https://productforums.google.com/forum/#!topic/chrome/nIHIV7DGBPc;context-place=topicsearchin/chrome/category$3ACanary%7Csort:relevance%7Cspell:false
https://www.reddit.com/r/networking/comments/60h4h1/bluecoat_proxy_and_chrome_57/?st=j11gnmvm&sh=bb196a17
https://threatpost.com/google-removing-sha-1-support-in-chrome-56/122041/
https://blog.gslin.org/archives/2016/11/21/6961/google-chrome-%E5%B0%87%E5%9C%A8-2017-%E7%9A%84-56-%E7%89%88%E5%81%9C%E6%AD%A2%E6%94%AF%E6%8F%B4-sha-1-ssl-certificate/
http://winintro.com/?Category=Chrome&Policy=Google.Policies.Chrome%3A%3AEnableSha1ForLocalAnchors
https://security.googleblog.com/2016/11/sha-1-certificates-in-chrome.html
https://www.chromium.org/administrators/policy-list-3#EnableSha1ForLocalAnchors

An update to our SHA-1 deprecation roadmap
Read more at https://blogs.windows.com/msedgedev/2016/04/29/sha1-deprecation-roadmap/#botVpEml4p81z0Vy.99

Google Chrome cannot access any https:\\ website and the return error is "Your connection is not private" (NET:ERR_CERT_WEAK_SIGNATURE_ALGORITHM)

VMware View 6 client (VMware Horzion View 3.4.0 client) – Disable the certificate warning and checking as a workaround of the login failure due to the SSL Certificate is expired.

Problem:

The VMware Security Server SSL certificate expired. It cause the View client did not able to connect the VDI farm.

Error message:

 

There are three different type of solution:

• Replace the self-signed certificates with other that are signed by an official public CA (or at least by the internal CA).
• Renew the self-signed certificates
• Disable this check.

There are several reasons we cannot renew or replace the expired certificate, so we go for the workaround solution to disable the checking.

To disable the checking on the View Client

1. Close the View Client

2. Go to HKLM\SOFTWARE\VMware, Inc.\VMware VDM\Client\Security and add the key “CertCheckMode” (DWORD) and value “0”

(By command: reg add "HKEY_LOCAL_MACHINE\Software\VMware, Inc.\VMware VDM\Client\Security" /v CertCheckMode /t reg_dword /d 0 /f)

Reference:

http://vinfrastructure.it/2011/12/vmware-view-5-disable-the-certificate-warning/

http://www.itninja.com/software/vmware/view-client-1/5-1201

http://www.failuretocomply.com/2014/06/quick-n-dirty-view-client-certificate.html

VMware View 6 client (VMware Horzion View 3.4.0 client) – Disable the certificate warning and checking as a workaround of the login failure due to the SSL Certificate is expired.