Security Certificate for foldingforum.org

[psaam0001]

Did someone need to update the security certificate for this forum??? Firefox is flagging it.

Paul

[Joe_H]

Yes, already checking into who takes care of that.

[psaam0001]

No problem....

Paul

[Foxbat]

Yeah, Safari was really concerned that I was going to compromise myself by continuing to this site. I’m glad to hear that it’s being addressed.

[Joe_H]

Yeah, my Safari complained as well. At least it allows for overriding that message and continuing to the site relatively easily, it can be harder in some other browsers.

[Jandska]

My Bitdefender was warning me as well (can override though) but the forum itself seems glitched for me (Firefox) - graphics are not loading correctly (tried to change themes but that didn't help neither deleting cookies - as an option on one theme). Yesterday it was ok

[FalconFour]

Bump! This is still a pretty serious issue... any browser used by anyone will flag the site as "warning! you shouldn't visit this site!" that has to be manually bypassed. It's an incredibly bad look.

I don't agree with the need for HTTPS everywhere... really makes the web a more messed-up place to be, but I also know all modern browsers have made it unavoidable. Such is the world we now live in.

Ought to make that certificate management automated!

[Hopfgeist]

[...]
Ought to make that certificate management automated!

Yes. Using letsencrypt is almost hassle-free, costs nothing and is easy to automate. In fact, doing it manually is strongly discouraged.

HG.

[gunnarre]

Not all users trust LetsEncrypt certificates due to their liberal policy of issuing it to any website (including phishing websites), but the users who care about that would be a minority.

[road-runner]

yea firefox complained also had to allow an exception

[joncrane]

This is a serious issue, what's the status on this? It's been a week now.

[Joe_H]

Latest I have heard was that a new certificate was obtained, they are looking into why it is not being used.

[ComputerUser]

Latest I have heard was that a new certificate was obtained, they are looking into why it is not being used.

I don't think they have already obtained a new certificate, because there is no new certificate logged in the Certificate Transparency logs. Each SSL Certificate must be logged in at least two different CT logs to be trusted by Google Chrome, so most CAs submit them immediately. As you can see in the link above the newest certificate (ID 2163700851) is the expired cert, so we have to wait until they manage to get and install a new one.

Cheers,

ComputerUser

[aetch]

There has been a number of new certificates issued under the *.foldingathome.org domain in the last few days.
I wonder if the forums have been overlooked because they're on a different domain name, issued by a different certification authority and possibly using a different process to obtain said certificate.

[Hopfgeist]

Not all users trust LetsEncrypt certificates due to their liberal policy of issuing it to any website (including phishing websites), but the users who care about that would be a minority.

I understand. Letsencrypt, as the name suggests, put their emphasis more on the encrypted connection (making that the default across the whole web), and somewhat less on trustworthy authentication.

HG.