Menu
GlobalSign certificate revocation error leaves websites inaccessible

GlobalSign certificate revocation error leaves websites inaccessible

Test revocation causes browsers and systems to reject GlobalSign-issued certificates

Users around the world have had trouble accessing some HTTPS websites due to an error at GlobalSign, one of the world's largest certificate authorities.

As part of a planned exercise, GlobalSign revoked one of its cross-certificates that allowed end-user certificates to chain to alternate root certificates. GlobalSign operates multiple roots, which are trusted in browsers and operating systems by default, and links them together through these cross-certificates.

The revocation of such a certificate was interpreted by some browsers and systems also as a revocation of the intermediate certificates that chained back to it. This was not really the case or the company's intention.

The blocking of intermediate certificates broke certificate chains and users started receiving certificate validation errors when trying to access websites with GlobalSign-issued certificates.

It seems that the revocation of the cross-certificate happened a while back, but the issues became apparent Thursday when GlobalSign started providing the revocation information for it over the Online Certificate Status Protocol (OCSP).

While the CA took immediate steps to fix the issue, users might still receive certificate errors for days to come because OCSP responses are cached in browsers and servers.

"The problem will correct itself in 4 days as the cached responses expire, which we know is not ideal," GlobalSign said in a report on its website. "However, in the meantime, GlobalSign will be providing an alternative issuing CA for customers to use instead, issued by a different root which was not affected by the cross that was revoked but offering the same ubiquity."

This means that affected certificate owners could obtain new certificates from a different GlobalSign-owned root that doesn't have this problem.

The company has provided a troubleshooting guide for the different types of certificates it issues as well as instructions to clear OCSP caches.


Follow Us

Join the newsletter!

Error: Please check your email address.

Featured

Slideshows

HP channel recognised at 2017 Partner Awards

HP channel recognised at 2017 Partner Awards

The HP Partner Awards 2017 at Shed 10 kicked off with an AMD-sponsored hackers lounge, a mysterious gaming style area filled with dry ice and red lasers, the waiters wearing Mr Robot style masks.

HP channel recognised at 2017 Partner Awards
Tech industry comes together as Lexel celebrates turning 30

Tech industry comes together as Lexel celebrates turning 30

Leading figures within the technology industry across New Zealand came together to celebrate 30 years of success for Lexel Systems, at a milestone birthday occasion at St Matthews in the City.​

Tech industry comes together as Lexel celebrates turning 30
HP re-imagines education through Auckland event launch

HP re-imagines education through Auckland event launch

HP New Zealand held an inaugural Evolve Education event at Aotea Centre in Auckland, welcoming over 70 principals, teachers and education experts to explore ways of shaping and enhancing learning using technology.

HP re-imagines education through Auckland event launch
Show Comments