Security certificates - why do I get problems on Logos.com product pages.

https://community.logos.com/discussion/comment/696573#Comment_696573

Anyone?

MJ. Smith

Sorry but I lack sufficient knowledge to even begin to debug: what security service do you use, what platform, what browser, what is the exact error message, have you looked the error message up in your browser and security websites ... If I had similar problems or if others had recently report a rash to such errors I'd have an idea where to start.

https://community.logos.com/discussion/comment/696576#Comment_696576

This is what I see as soon as I click on the "certificate error" in the end of the browser address field (Windows 7 32 bit, WI 11 (mentioned that)

About as far as I can go with out assistance!

Thanks Kevin

https://community.logos.com/discussion/comment/696581#Comment_696581

Sorry cut and paste didn't seem to work

Rosie Perera

Can you post an example of a URL that you get that error on?

I notice security problems on some forum pages but not all. I get the yellow triangle warning on the lock icon:

Not sure if this is a related problem or not.

Bradley Grainger explained a problem with security certificates that was fixed a while back: https://community.logos.com/forums/t/83687.aspx

https://community.logos.com/discussion/comment/696583#Comment_696583

I don't get that but

https://www.logos.com/product/49485/first-things

gives me

https://community.logos.com/discussion/comment/696585#Comment_696585

Is it some confusion between Logos.com and Verbum.com

in the URL and the security certificate

Regards Kevin

https://community.logos.com/discussion/comment/696586#Comment_696586

bump

Matt Hamrick

https://community.logos.com/discussion/comment/696582#Comment_696582

Just install the certificate and be done with it.

Glenn Airoldi (Faithlife)

https://community.logos.com/discussion/comment/696622#Comment_696622

Hi all,

Thank you for the URLs and screenshots. We're looking into this and will remedy.

I am often recently getting "security certificate" problem notifications on my browser (IE 11) when I enter some (not all) logos product pages.

We're double-checking all of our certificate configurations, but we cannot currently reproduce this.

A couple of points of clarification: The warning that Rosie describes is generally referred to as a mixed content warning and what it means is that some component of the page is not being loaded over https. On the forums specifically, it looks like the images for emoticons are loaded over http and not https. That's a different problem than the one you're reporting.

There are a handful of possible causes for the issue you're reporting, but some of them are beyond our control. Again, we are double and triple checking the ones that are within our control.

The most common cause I have seen other than configuration issues on our side is if your browser is configured to use a proxy (sometimes used by businesses, academic institutions, your off-the-shelf web firewall or creative internet service providers) and that proxy is misbehaving OR using old technology. There should be more information about which website's certificate your browser is being served and it's probably hiding behind that "More information" button. Being able to see that, if you have a moment, would be helpful.

https://community.logos.com/discussion/comment/696666#Comment_696666

The Logos product pages seem to be behaving at the moment - although I am still getting problems with Vyrso.com

I have installed the certificate - and yet is still persist in raising this error

Thanks for your attention. Kevin

https://community.logos.com/discussion/comment/696677#Comment_696677

I'd still be very interested in any proxy configuration on your machine. You report using IE 11, which should handle our configuration just fine, but what you're describing looks and smells like a proxy or intermediate application that isn't coping well with a technology we use called Server Name Indication or SNI.

We know this affects ancient versions of browsers and operating systems, but if you're seeing it with IE 11 on a recent version of Windows, then there's probably something between you and us that isn't SNI-savvy.

https://community.logos.com/discussion/comment/696715#Comment_696715

I have the same problem, especially with the Vyrso web site, and recently has started with the Logos.com web site, but not as yet with the faithlife.com web site (no issues with faithlife.com).
I am on I.E. 10 rather than I.E. 11 because business use limitations prevent me from upgrading to I.E. 11.
Here is what Wikipedia says about SNI, please note what I have set in bold text:
"When making a TLS connection the client requests a digital certificate from the web server; once the server sends the certificate, the client examines it and compares the name it was trying to connect to with the name(s) included in the certificate. If a match occurs the connection proceeds as normal. If a match is not found the user may be warned of the discrepancy and the connection may abort as the mismatch may indicate an attempted man-in-the-middle attack. However, some applications allow the user to bypass the warning to proceed with the connection, with the user taking on the responsibility of trusting the certificate and, by extension, the connection."
By the way, I have no proxy server settings designated in my Internet Explorer configuration (please see next 3 screen shots below).
Please advise if solution is found. Thank you.

Donnie Hale

https://community.logos.com/discussion/comment/699967#Comment_699967

I am on I.E. 10 rather than I.E. 11 because business use limitations prevent me from upgrading to I.E. 11.

Can you paste a screenshot of the certificate information for whatever certificate is being returned? Also, are you up-to-date on all your Windows updates? Some of those update the certificate store (with root certificate information) in Windows. It's possible that those "business limitations" are behind on Windows updates.

Donnie

https://community.logos.com/discussion/comment/700230#Comment_700230

https://community.logos.com/discussion/comment/700576#Comment_700576

I'm all up-to-date on my Windows updates. In case this particular certificate is "bad", should I delete the certificate and then re-access the Vyrso web site to automatically receive a new certificate that might work like it should? Thank you.

https://community.logos.com/discussion/comment/700577#Comment_700577

Based on all of my testing, when I use SNI-capable tools, I cannot reproduce your issue. When I disable SNI support, it reproduces every time.

The screen shot you posted with the annotation:

By the way, I have no proxy server settings designated in my Internet Explorer configuration

doesn't actually show that you have no proxy configured. It shows that you have no manually configured proxy. You have the "Automatically detect settings" checked. If you've got an anti-virus that protects you from the web by using a local proxy and/or something configured by your IT staff (if there is one involved), it may be picking up proxy settings anyway (see the note about automatic settings overriding manual ones).

I'm really sorry that this isn't working well for you. I've seen plenty of cases where that "detect settings" checkbox leads to problems just like this one. But, of course, without being able to literally examine your local network configuration, I cannot say conclusively that it is, in fact the issue.

What I can say is: the symptoms you are experience are the expected behavior for tools that do not support SNI.

I'm really sorry and we'll keep looking for a solution.

Donnie Hale

https://community.logos.com/discussion/comment/700595#Comment_700595

What I can say is: the symptoms you are experience are the expected behavior for tools that do not support SNI.

For the individual who was seeing the errror accessing vyrso.com but was being returned a verbum.com certificate, which does sound like an SNI issue, wouldn't affirmation of your hypothesis consist of the user accepting the certificate so that he/she navigates to the site and then see if he/she arrives at the verbum web site (rather than vyrso)? I think that would prove that the request was handled by the verbum "web site" or "virtual host" - on whatever web server you're using.

For folks wondering about SNI, you can think about it this way. The HTTP "Host" header is to http (i.e. without SSL/TLS) as SNI is to https (i.e. SSL/TLS). Believe it or not, there was a time when the HTTP "Host" header was not a standard. If you wanted to host multiple sites at the same IP address, it was a real pain. Yes, I lived through that. The earliest SSL/TLS protocols broke this because HTTP headers are encrypted under SSL/TLS. So SNI was added to the protocol to allow for that capability.

Donnie

Donnie Hale

https://community.logos.com/discussion/comment/700576#Comment_700576

Do a google search on lrscorp. It's somehow related to Faithlife / Logos, but I'm not sure how.

My suspicion is that your automatically detected proxy settings are forcing your requests through an SNI-ignorant proxy infrastructure. But I would love Faithlife to respond about what / where there's anything from Faithlife / Logos responding with an lrscorp.net certificate.

Donnie

https://community.logos.com/discussion/comment/700665#Comment_700665

For the individual who was seeing the errror accessing vyrso.com but was being returned a verbum.com certificate, which does sound like an SNI issue, wouldn't affirmation of your hypothesis consist of the user accepting the certificate so that he/she navigates to the site and then see if he/she arrives at the verbum web site (rather than vyrso)? I think that would prove that the request was handled by the verbum "web site" or "virtual host" - on whatever web server you're using.

TL;DR:

If a SNI-troubled client negotiates a TLS session using the "wrong" certificate (e.g. a verbum.com cert for requests to vyrso.com), the web server will still serve the expected web content—requests for vyrso.com will still return vyrso.com content even if the verbum.com certificate is used to negotiate the TLS session.

Longer version:

I'm not entirely sure how much technical detail people in this thread want, and I'm hoping to ditch our use of SNI for these sites, but here goes (I'm simplifying a couple of steps; indulge me):

SNI affects the TLS negotiation, but wouldn't affect the HTTP request that is wrapped by that TLS session. When your browser reaches out to the web server to negotiate TLS, it does a DNS lookup of the IP address associated with the name. It then opens a connection to port 443 and initiates the TLS negotiation. If it supports SNI, it will use the host portion of the URL to specify a hostname parameter sent along to help the server determine which certificate should be used for the TLS session. If the client (or any intermediary) does not support SNI, it will simply make the request to the raw IP address and the server will use whichever certificate it is configured to use for that IP address by default. If the default certificate configured for the IP happens to match the host in the client-specified URI, all is well. If the cert does not match, the browser will (typically) warn the user. If the user clicks some sort of "ignore" or "allow" link or button, the TLS negotiation will succeed.

"Inside" this TLS session, the browser will send the HTTP request which will almost certainly include an HTTP Host header. The web server will use the contents of that HTTP request to decide which content to serve. An HTTP request for https://vyrso.com will send an HTTP Host header for vyrso.com even if the TLS session is negotiated using a certificate for a different domain

If anyone is *really* interested in hashing out the details in more depth, my email address fits the format firstname.lastname at faithlife.com. We can save everyone else from the boring details.

https://community.logos.com/discussion/comment/700666#Comment_700666

But I would love Faithlife to respond about what / where there's anything from Faithlife / Logos responding with an lrscorp.net certificate.

lrscorp.net is a domain we have registered

http://whois.icann.org/en/lookup?name=lrscorp.net

https://community.logos.com/discussion/comment/700595#Comment_700595

Cameron, thanks much for looking further into this. I will take a look at tinkering with some other settings, I think you might be right about what my anti-virus software may be doing. By the way, I do hope Logos finds a solution, because I cannot imagine the large number of potential customers seeing the same thing I do and avoiding the various Logos web sties because of concern about security risks. This cannot be good for business revenue. The only reason I have gone ahead and bypassed the security warnings is because I am a long-time Logos customer and I know that this problem is likely not a valid security threat because I trust Logos and its many vigilant discussion forum customers to keep a good eye out and keep things running right. Thank you for all your help.

https://community.logos.com/discussion/comment/700595#Comment_700595

Hi, Cameron. I unchecked "Automatically detect settings" and restarted my I.E. web browser and it did NOT resolve the problem, I get the same security warnings. So, perhaps that leaves me with trying to figure out if I need to change a configuration setting on my security software. By the way, I am not using any company settings on my web browser, I merely meant to say that for access into my company network I am currently limited to I.E. version 10 for compatibility reasons with company legacy software, and so cannot yet upgrade to version 11. So, my I.E. 10 settings are pretty much "out-of-the box" Windows 7 default settings. However, I would be quite surprised if Logos software was incompatible with I.E. version 10 as it is not that old, and there may be many other people in my situation you are one version behind, so there would be no reason to exclude those folks from being Logos customers or potential Logos customers, in my thinking.

Sarah Blake LaRose, D.Min.

https://community.logos.com/discussion/comment/701792#Comment_701792

In case this helps anyone... I have also been having this problem within the last week. (I am also on an older computer with IE 10.) It seems to be fixed after I checked all three TLS boxes in Internet options under advanced. I assumed they were all checked, but two of them were unchecked.

https://community.logos.com/discussion/comment/706827#Comment_706827

Thank you, Sarah! This fixed my issue as well. I only had "TLS 1.0" checked as default. Once I also checked "TLS 1.1" and "TLS 1.2", the issue was resolved. I do not know why Logos tech. support is not aware that the default I.E. 10 configuration may not have all of the TLS settings checked, but this should be added to Logos Tech. Support's knowledge base as it will surely help resolve the issue for everyone else who has this problem. Thanks again for sharing your solution!

Bradley Grainger (Logos)

https://community.logos.com/discussion/comment/707046#Comment_707046

I do not know why Logos tech. support is not aware that the default I.E. 10 configuration may not have all of the TLS settings checked, but this should be added to Logos Tech. Support's knowledge base as it will surely help resolve the issue for everyone else who has this problem.

I didn't know IE10 didn't support newer TLS versions by default, either. I'll pass this information along. Thanks!

Mark Barnes

https://community.logos.com/discussion/comment/707121#Comment_707121

I didn't know IE10 didn't support newer TLS versions by default, either. I'll pass this information along. Thanks!

I reported another SSL error last week that's still not been acknowledged: https://community.logos.com/forums/t/102023.aspx