Tech: Firefox OSCP certificates problem

Subject: Tech: Firefox OSCP certificates problem
From: The Fooles Troupe
Date: 17 May 08 - 08:16 AM

My web banking stopped working. Something about OSCP (or something - I can't cut and paste from the popup window that says that) certificates too old. Any ideas - remember JiK - Win9x.... :-P
FF V2.0.0.14.

Btw, I got in with Opera 9.27 ok.

Robin

Subject: RE: Tech: Firefox OSCP certificates problem
From: mack/misophist
Date: 17 May 08 - 11:26 AM

Web banking uses SSL to set up a secure page to work on. Browsers compare certificates to a list of established providers for validation. Since certificates are commercial products, they have expiration dates. This seems to be the problem. If you have a chance to accept it anyway you can try that but it's probably a bad idea. I'd call the bank to find out what's going on.

A certificate is a digital document that guarantees that the issuer has verified the identity of the purchaser. It also contains code to set up an encrypted link for the transaction. My ISP issued it's own certificate and Opera didn't like it when I tried to pay my bill on line.

Subject: RE: Tech: Firefox OSCP certificates problem
From: JohnInKansas
Date: 17 May 08 - 02:09 PM

I'd say it's good advice: If you have trouble with your bank, ask the bank. They should be able to tell you fairly painlessly what the problem is and how to get it fixed - or that they will fix it.

If you go in without a valid certificate, your transaction likely won't be encrypted or will be encrypted by a "weaker" method that could expose you to it being "intercepted" by someone who shouldn't see it. Some sites may just refuse the connection rather than allow you to take the risk.

It is possible that you have a browser setup glitch. For some kinds of transactions you may have to change a browser setting to require contact with a specific site to use encryption at the proper level. If the level you've set doesn't match what the site expects, the site could "decline to show" a valid cert that it has. The "standard" for secure sites is generally 128-bit encryption. Not being a user, I can't guess where/whether Firefox needs a tweak of this kind.

The reference to OSCP is a bit puzzling. I don't know of a use of that acronym that relates to site connection and transaction security. As I've seen it, that's a "certification" that security specialists can get that's supposed to prove that they know all the dirty tricks that crackers/malware mongers might use to mess up someone's site - sort of like a specialized drivers' license. That certificate applies to a specific person, but not to a site or to a method of data transmission. That I haven't seen it doesn't mean that another usage isn't fairly common, of course.

John

Subject: RE: Tech: Firefox OSCP certificates problem
From: AlexB
Date: 17 May 08 - 08:19 PM

I'm wondering if it could be the debian OpenSSL issue. It seems to be affecting a lot of systems. So maybe they need to regenerate their keys and certs.

Subject: RE: Tech: Firefox OSCP certificates problem
From: The Fooles Troupe
Date: 17 May 08 - 11:49 PM

OK - Win9x - Can't see what it would have to do with Debian - and was tired and on way to bed last night.

System unchanged from the day before (except see 'sorta crash' below). Working fine today (also see bleow).

Funnily enough the bank supports FF and does not like Opera! :-)

Ok I had a weird 'sorta crash' just before - some idiot had give a web page I saved a 10,000 char file name !!! and I couldn't rename it shorter! Hung some things for a bit, but was able to use my EditPlus prog to open the html file and then save it as a shorter name (Win9x has limits), then copy the files in the dir of the same name over to a shorter name. I use the 'save whole page' option (which dumps the graphics, etc in a dir of same name as the html file) not the JiK favoured 'mungle it all on one archive file' option!!! :-P

Also immediately after - my media player 'broke its sound player part' when playing wmv files.

I then attempted to do my banking. When shutting down later I had a lot of scandisk errors autofixed too.

BUT

I am aware of the general security stuff and the certificates stuff - I try to keep up - I even get 'HACKIN9' magazine regularly to keep up with the latest security war stuff.

Neither the Bank nor the unrelated Credit union would work on FF - same error messages. Couldn't even contact either mob using their 'contact us' procedure - same error.

However Opera worked immediately after. (But WHY did it not fail with the same OSCP error?!!!!) I used it to do the transactions immediately after and then contact the Bank and complain - of course the reply will take about a month to turn up as usual.

Ok, may have blown the OSCP, but it was those 4 letters - as it OCSP? dunno - couldn't cut and paste... Nope OSCP... brain still sorta works... :-P


OSCP
                   
Acronym        Definition
OSCP        Offensive Security Certified Professional (Certification)
OSCP        Office of Science Coordination and Policy (EPA)
OSCP        Offutt Subnet Communications Processor
OSCP        Oil Spill Contingency Plan
OSCP        oligomycin sensitivity-conferring protein
OSCP        On-Scene Control Point
OSCP        Online Certificate Status Protocol (digital certificates)
OSCP        Optical Supervisory Channel Protocol (Cisco)
OSCP        Oracle Storage Compatibility Program

from http://acronyms.thefreedictionary.com/OSCP


Further down page was "Osculate (mathematics)" - see - Maths CAN be sexy...

Hey - would an Offensive Security Certified Professional be bad tempered? hehe... sorry...


looks like
OSCP        Online Certificate Status Protocol (digital certificates)

en.wikipedia.org/wiki/Online_Certificate_Status_Protocol
searchsecurity.techtarget.com/sDefinition/0,,sid14_gci784421,00.html

ocsp
Appendix A defines OCSP over HTTP, appendix B accumulates ASN.1 syntactic elements
and appendix C specifies the mime types for the messages. ...
www.ietf.org/rfc/rfc2560.txt



BTW, just did test transaction - worked OK - no error. So it seems unlikely that it WAS FF. But WHY did Opera work then - do they keep separate copies of certs etc? And why did Opera get a new cert - as I haven't used it for months, and the certs for the bank etc couldn't possibly be 'new' - they would have had to have benn 'transferred' again from the 'source'.

Was it an OSCP server glitch?

Subject: RE: Tech: Firefox OSCP certificates problem
From: The Fooles Troupe
Date: 18 May 08 - 04:58 AM

Well a reinstall of mplayer fixed that... as I thought it would.

Strange JiK, but they ain't makin' updates of stuff to work on Win9x any more.... :-P

Subject: RE: Tech: Firefox OSCP certificates problem
From: JohnInKansas
Date: 18 May 08 - 08:16 AM

A year or two ago they said they were going to stop serving up even "critical fixes" to Win9x, but they got stopped (sort of) when someone pointed out that it was the latest thing that could be legally exported to China, and they had several million users there.

The word seems to be though that all the people in China are running bootleg copies of WinXP (or Vista). [If they're gonna steal it they deserve Vista, IMO.]

I'm not surprised that they broke some application programs for Win9x. The WinXP patches finally crippled my Office XP (it came on my OEM WinXP Pro computer) so much that I finally put Office 2007 on.

If Vista is an Edsel (as many people think) Office 2007 is a Spruce Goose.

John