freebsd security - May 2015 - Forums.FreeBSD.org - SSL Issue?

Qualys report chain issues

Sent from my iPhone
> On 13 May 2015, at 16:29, Paul Franklin <paul.franklin at grg.com>
wrote:
> 
> Hi James,
> 
> Yes I agree, it looks like the wrong intermediate cert has been used...
> 
> Certificate:
>  Subject: CN=forums.freebsd.org
>  Issuer: CN=Gandi Standard SSL CA 2
> 
> Intermediate:
>  Subject: CN=Gandi Standard SSL CA
> 
> The certificate issuer CN doens't match the intermediate subject CN
> (note the missing 2)
> 
> 
> Regards,
> Paul.
> This e-mail message including any attachment(s) is intended for the
addressee only and may be confidential. If you are not the intended addressee,
we request that you notify us immediately and delete this e-mail including any
attachment(s), without copying, forwarding, disclosing or using this (these) in
any other way.
> 
> Registered Name: The Grass Roots Group UK Ltd Place of Incorporation:
England & Wales
> Registered Office: Pennyroyal Court, Station Road, Tring, Herts. HP23 5QY
> Registered No.: 4155659
> 
> _______________________________________________
> freebsd-security at freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-security
> To unsubscribe, send any mail to "freebsd-security-unsubscribe at
freebsd.org"

On 13 mai 2015, at 23:18, Anders Gulden Olstad wrote:
> Qualys report chain issues
that's pretty odd, because I've checked too just after sending my reply
to the list (message id A2D58CCB-8B0A-40FF-9ED1-89B698A830DD at patpro.net), and
Qualys reported no issues at all about the chain. That was about 7-8 hours
before your message.

But well, the global note was B at this time, and now it's A+. They
obviously upgraded TLS from 1.0 to 1.2, ditched support for "old"
browsers, and made other cipher tuning. Good job admins (though I would have
been a bit more conservative about browser support).

regards,
patpro