chrome 在 linux 下今天爆发, 绝大多数 https 访问不了.

今天周一, 回公司后打开邮箱发现thunderbird和iceweasel(firefox)下web版的outlook都访问不了. 于是发邮件个Technical support group,

当时报错如下
===我是错误的分割线 Start========
Secure Connection Failed

An error occurred during a connection to cdcmail.synnex.com. Peer's Certificate has been revoked. (Error code: sec_error_revoked_certificate)

The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
Please contact the website owners to inform them of this problem.
===我是错误的分割线 End=========

TSG让我等会儿重试下. 几分钟后重试可以收发了, 不过速度下降了.
接下来, 大约半个小时后, 我有需要连github, 发现连不上了

https://ruby-china.org https://github.com 都连不上了.
点开github
报错
===我是错误的分割线 Start========
Your connection is not private

Attackers might be trying to steal your information from github.com (for example, passwords, messages, or credit cards).

ReloadHide advanced
github.com normally uses encryption to protect your information. When Chrome tried to connect to github.com this time, the website sent back unusual and incorrect credentials. Either an attacker is trying to pretend to be github.com, or a Wi-Fi sign-in screen has interrupted the connection. Your information is still secure because Chrome stopped the connection before any data was exchanged.

You cannot visit github.com right now because the website uses HSTS. Network errors and attacks are usually temporary, so this page will probably work later.

NET::ERR_CERT_AUTHORITY_INVALID
===我是错误的分割线 End=========

点开证书一看, 机构不是Digi那个. firefox下可以正常访问, 我加了例外. 但是chrome就是不让加例外. 怎么办呢? 有人知道这个chrome的证书流程吗
Common Name (CN) github.com
Organization (O) GitHub, Inc.
Organizational Unit (OU) <Not Part Of Certificate>
Serial Number 3F:C2:EE:F3
Issued By

Common Name (CN) FortiGate CA
Organization (O) Fortinet
Organizational Unit (OU) Certificate Authority

silverfox

2014-09-16 00:39:27 +08:00

我来抛砖引玉一下，以下是我的推测，不能保证完全正确。

FortiGate 是专门做防火墙的厂商，应该是你们公司新上了一套设备用来监控员工的上网行为。它在解析 HTTPS 流量，所以需要将那些使用 HTTPS 通信的网站证书全换成自己签发的。

Github 这个网站表明自己是支持 HSTS 的，而楼主机器上的 Chrome 之前记录了 github.com 证书的公钥指纹。这回被替换掉的证书肯定无法与之前的一致，所以浏览器识别为中间人攻击，拒绝连接。其他人机器之前没有访问过 Github 所以这时可以正常打开。

不过我认为他们还是有一些使用 HTTPS 的网站是无法打开的，因为 Chrome 内置了一部分网站证书的签发者正确的证书。所以如果网站的签发者不正确（FortiGate CA），一样拒绝连接。
https://src.chromium.org/viewvc/chrome/trunk/src/net/http/transport_security_state_static.json
https://src.chromium.org/viewvc/chrome/trunk/src/net/http/transport_security_state_static.certs

解决办法：
上策：向领导建议不要解析 HTTPS 网站流量
下策：使用 Firefox