Arch Linux

shetland_breeder

Member

From: England

Registered: 2010-05-17

Posts: 67

Website

Strange Chromium problem

Hi,

I have four Arch installations - two laptops connecting by wifi, and two desktops with wired connections.

They all have Chromium installed, and all but one of the desktops work fine. On one of the desktops Chromium works fine on all the HTTPS sites I've tried except Google, Of course this is the PC  I use the most, and probably not coincidentally, the one with most packages installed,

If I try to connect to Google I get a Privacy error: NET::ERR_CERT_AUTHORITY_INVALID. Running from the command line the error is: ERROR:cert_verify_proc_nss.cc(921)] CERT_PKIXVerifyCert for www.google.co.uk failed err=-8172.

I found an old Chromium bug with the same error, but the actions to resolve that had no effect on my bug. I've re-installed all the ca-cert packages and Chromium.

I don't know when this started happening - Chromium used to work OK - as I only use Chromium when Firefox is having an off day.

Does anyone have any ideas what this might be due to?

Thanks.

ewaller

Administrator

From: Pasadena, CA

Registered: 2009-07-13

Posts: 20,702

Re: Strange Chromium problem

I assume these are all on the same network, and that you are not using proxies or VPNs.
What if you just force a reload without cache?   This is done (I believe) in Chromium with Ctrl-F5

---

Nothing is too wonderful to be true, if it be consistent with the laws of nature -- Michael Faraday
The shortest way to ruin a country is to give power to demagogues.— Dionysius of Halicarnassus
---
How to Ask Questions the Smart Way

shetland_breeder

Member

From: England

Registered: 2010-05-17

Posts: 67

Website

Re: Strange Chromium problem

All my PCs are on the same router, which I haven't touched for over a year now. No VPN, no proxy.

Ctl+F5 and Shift+F5 make no difference.

I also have Midori installed and that works OK on all the HTTPS sites I've tried.

adomol

Member

Registered: 2014-12-18

Posts: 26

Re: Strange Chromium problem

I would check your hardware clock on that machine to make sure it is set properly.

shetland_breeder

Member

From: England

Registered: 2010-05-17

Posts: 67

Website

Re: Strange Chromium problem

Hardware  clock is OK. All the PCs use NTP to set the clock. I would guess that if the clock was wrong FF and Midori would get an error too since HSTS is required by the website?

seth

Member

From: Won't reply 2 private help req

Registered: 2012-09-03

Posts: 78,118

Re: Strange Chromium problem

chrome://flags/
Activate "Show certificate link" - allows you to inspect the certificate (right click the "secure" token in the urlbar)
Should be from "Google Internet Authority G3" - please post the hashes.

Can you reach google.com w/o warnings?

---

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc

shetland_breeder

Member

From: England

Registered: 2010-05-17

Posts: 67

Website

Re: Strange Chromium problem

google.com in the URLbar redirects to google.co.uk and gets the same error.

The hashes are:

SHA-256 Fingerprint	AC DB A3 25 8E 67 20 53 4C 2F 34 1E EA B2 0A BE
                        A1 7C CB 5A 06 3F 29 00 8F B2 6E 24 AB B4 DD 2C

SHA-1 Fingerprint	D1 C0 33 06 DE 92 C9 33 88 58 95 61 4C 90 70 60
                        4F 3A 43 2B

shetland_breeder

Member

From: England

Registered: 2010-05-17

Posts: 67

Website

Re: Strange Chromium problem

And the hashes from the other desktop where Chromium can load gogole are identical:

SHA-256 Fingerprint	AC DB A3 25 8E 67 20 53 4C 2F 34 1E EA B2 0A BE
                        A1 7C CB 5A 06 3F 29 00 8F B2 6E 24 AB B4 DD 2C
SHA-1 Fingerprint	D1 C0 33 06 DE 92 C9 33 88 58 95 61 4C 90 70 60
                        4F 3A 43 2B

seth

Member

From: Won't reply 2 private help req

Registered: 2012-09-03

Posts: 78,118

Re: Strange Chromium problem

On the details page, is the hierarchy CA-R2 => G3 => www.google.co.uk?
Any obvious problems with either of those? (date ranges etc.)?

---

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc

shetland_breeder

Member

From: England

Registered: 2010-05-17

Posts: 67

Website

Re: Strange Chromium problem

The hierarchy does not have CA-R2, only G3=>www.google.co.uk

The dates on the general page are good.

seth

Member

From: Won't reply 2 private help req

Registered: 2012-09-03

Posts: 78,118

Re: Strange Chromium problem

Di you have GlobalSign Root CA - R2 in chrome://settings/certificates ?

---

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc

shetland_breeder

Member

From: England

Registered: 2010-05-17

Posts: 67

Website

Re: Strange Chromium problem

If that's the one in chrome://settings/certificates/authorities/org.GlobalSign then the answer is 'Yes', but it's marked as 'UNTRUSTED' as is the CA-R3 certificate. The other two are OK.

shetland_breeder

Member

From: England

Registered: 2010-05-17

Posts: 67

Website

Re: Strange Chromium problem

So I exported the 'Untrusted' certificate and the one from my other desktop machine, which _is_ trusted, and diff says they are identical.

seth

Member

From: Won't reply 2 private help req

Registered: 2012-09-03

Posts: 78,118

Re: Strange Chromium problem

Can you edit an entrust it? I've no idea at hand why it's not being trusted - especially if it's the same as the trusted ones on your other machines.
Maybe

ls {/usr/share,/etc}/ca-certificates/trust-source/blacklist

?

---

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc

shetland_breeder

Member

From: England

Registered: 2010-05-17

Posts: 67

Website

Re: Strange Chromium problem

That seems to have sorted it - thanks very much.

It would be interesting to know why, but I shall make a note of in case it happens again.

Last edited by shetland_breeder (2017-11-26 15:58:52)

shetland_breeder

Member

From: England

Registered: 2010-05-17

Posts: 67

Website

Re: Strange Chromium problem

Both the blacklists are empty...