Search code examples
algorithmsecuritycertificatex509pkix

www.googleadservices.com uses an invalid security certificate


www.googleadservices.com uses an invalid security certificate. www.googleadservices.com shows following issue:

The certificate was signed using a signature algorithm that is disabled because it is not secure.

HTTP Strict Transport Security: false

HTTP Public Key Pinning: true

Please help


Solution

  • Your client appears to be misconfigured and producing spurious messages. Or, your connection is being intercepted and the proxy is using weak/wounded algorithms. Misconfigured and out of date TLS proxies are a known problem. Also see Jarmoc's BlackHat talk SSL Interception Proxies and Transitive Trust.

    Here's my view of www.googleadservices.com. As far as I am aware, both RSA-2048 and SHA-256 are acceptable by today's standards:

    $ openssl s_client -connect www.googleadservices.com:443 -servername www.googleadservices.com -tls1 | openssl x509 -text -noout
    depth=3 C = US, O = Equifax, OU = Equifax Secure Certificate Authority
    verify return:1
    depth=2 C = US, O = GeoTrust Inc., CN = GeoTrust Global CA
    verify return:1
    depth=1 C = US, O = Google Inc, CN = Google Internet Authority G2
    verify return:1
    depth=0 C = US, ST = California, L = Mountain View, O = Google Inc, CN = www.googleadservices.com
    verify return:1
    Certificate:
        Data:
            Version: 3 (0x2)
            Serial Number: 294569083916079532 (0x416850568a151ac)
        Signature Algorithm: sha256WithRSAEncryption
            Issuer: C=US, O=Google Inc, CN=Google Internet Authority G2
            Validity
                Not Before: Jan 25 10:41:05 2017 GMT
                Not After : Apr 19 10:09:00 2017 GMT
            Subject: C=US, ST=California, L=Mountain View, O=Google Inc, CN=www.googleadservices.com
            Subject Public Key Info:
                Public Key Algorithm: rsaEncryption
                    Public-Key: (2048 bit)
                    Modulus:
                        00:a2:85:55:c4:95:3d:38:30:8f:75:cc:b2:55:59:
                        9f:9b:6f:e5:07:92:48:e7:c9:4e:3c:9c:4a:b6:a4:
                        2f:05:1e:6f:8e:61:0d:85:bb:6e:be:8a:a9:27:66:
                        e9:31:da:ec:2a:29:8f:b5:11:05:fb:b8:d6:53:c1:
                        80:f4:f7:75:68:e0:46:5e:3d:9b:64:7c:26:98:95:
                        91:d8:e2:c7:8e:12:6b:58:24:70:9c:04:b7:da:f3:
                        6e:ed:a1:a0:c1:ad:32:6a:62:e7:91:8d:84:48:c9:
                        16:a8:49:e1:a7:bd:18:3e:fa:85:be:84:67:b4:c1:
                        28:24:94:d8:76:f3:fe:ac:e4:09:55:f0:42:49:97:
                        2d:3e:f5:c8:41:5d:67:c6:7d:4f:7f:56:80:1f:e9:
                        3e:fe:90:83:89:8c:9a:db:be:6c:60:b2:64:08:d0:
                        d9:c0:01:1a:a5:15:28:dc:89:39:52:94:b2:12:a7:
                        b4:ff:6b:56:56:a9:38:bb:34:4a:cc:9e:9a:57:29:
                        d1:bc:21:46:84:0d:3d:08:23:6f:27:e5:c9:4d:81:
                        e2:e9:b4:b0:05:b4:35:bd:73:13:cc:4b:db:78:51:
                        bb:85:f9:6f:18:38:cd:2b:55:cf:2a:5b:7c:17:de:
                        c1:e5:40:4c:7f:d5:8d:09:dd:c4:86:49:a3:92:ea:
                        39:a1
                    Exponent: 65537 (0x10001)
            X509v3 extensions:
                X509v3 Extended Key Usage:
                    TLS Web Server Authentication, TLS Web Client Authentication
                X509v3 Subject Alternative Name:
                    DNS:www.googleadservices.com
                Authority Information Access:
                    CA Issuers - URI:http://pki.google.com/GIAG2.crt
                    OCSP - URI:http://clients1.google.com/ocsp
    
                X509v3 Subject Key Identifier:
                    F4:A4:33:19:C3:E0:AB:5C:C9:53:90:26:7E:AB:4E:CB:B3:99:1C:59
                X509v3 Basic Constraints: critical
                    CA:FALSE
                X509v3 Authority Key Identifier:
                    keyid:4A:DD:06:16:1B:BC:F6:68:B5:76:F5:81:B6:BB:62:1A:BA:5A:81:2F
    
                X509v3 Certificate Policies:
                    Policy: 1.3.6.1.4.1.11129.2.5.1
                    Policy: 2.23.140.1.2.2
    
                X509v3 CRL Distribution Points:
    
                    Full Name:
                      URI:http://pki.google.com/GIAG2.crl
    
        Signature Algorithm: sha256WithRSAEncryption
             53:db:ed:18:e3:47:b7:6d:a7:7d:5a:e1:d0:ce:be:af:48:79:
             ea:1b:d4:22:64:1e:73:2d:5f:24:b2:34:e7:d8:7d:fd:f5:22:
             1d:e7:5b:32:3c:f6:d2:59:87:9c:35:8b:95:5f:74:69:c7:d0:
             94:1e:ce:09:de:1c:f8:48:a4:25:5b:6b:36:d6:15:87:90:2c:
             a8:84:26:65:cc:fb:33:05:ba:90:dc:a0:58:00:cc:1d:b1:6b:
             ed:6c:dd:e7:83:cd:bd:6c:27:ee:0e:cc:11:00:b1:49:f9:4c:
             59:6e:50:15:b0:22:9f:31:ac:10:f4:dc:14:d2:5a:be:6d:47:
             f5:fd:c8:d8:bd:ff:3a:de:29:dd:a9:ac:fa:5b:63:cc:ee:50:
             b6:25:5e:b5:4a:c1:fa:c2:bb:c8:f2:33:e5:92:b9:ec:18:13:
             2f:0b:70:86:6b:f6:94:15:ec:53:ed:af:52:2f:3e:06:9a:8d:
             b5:80:a5:bc:b5:b3:56:92:a8:1b:c6:d1:cd:49:b4:04:65:b4:
             be:9a:56:1c:e9:17:84:54:24:85:c4:07:ce:4e:dd:0b:f6:8d:
             53:54:66:90:7f:36:77:3e:8f:40:79:79:73:75:d1:66:bd:b2:
             41:ee:5f:d2:4f:e2:fa:78:c1:3d:e4:ff:a4:ae:7a:94:81:af:
             d2:6a:60:2b