IMPORTANT - TILLIA CERTIFICATE (TLS?) REVOKED!?

[Quistess Alpha]

Cannot log into the forums on firefox. When attempting to view the login page:

Quote

Secure Connection Failed

An error occurred during a connection to auth.tilia-inc.com. Peer’s Certificate has been revoked.

Error code: SEC_ERROR_REVOKED_CERTIFICATE

• The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
• Please contact the website owners to inform them of this problem.

This was after having logged in to secondlife.com, so probably related to the new(ish) one-logon system. 

error happens on an intermediate redirect page auth.tillia-inc.com/authorize?... further research sugests the problem might have something to do with OCSP?

Edited August 5 by Quistess Alpha

[Love Zhaoying]

That's weird, if the Forums use a cert associated with Tillia..

Also, why just Firefox? Does it use different security protocols than "Chromium-based" browsers? That would make sense..

 

[Quistess Alpha]

Just now, Love Zhaoying said:

Also, why just Firefox? Does it use different security protocols than "Chromium-based" browsers? That would make sense..

 

as I said in my edit, I suspect it's because on firefox I logged into secondlife.com first, then the forums, but I'm here on chromium, without logging in there first.  clearing cookies doesn't seem to do anything, so yeah, maybe just a browser/plugins difference?

[beethros Karas]

2 hours ago, Quistess Alpha said:

Cannot log into the forums on firefox. When attempting to view the login page:

same here...

[bigmoe Whitfield]

I'm not sure what's going on, as the certificate is valid.

https://www.sslshopper.com/ssl-checker.html#hostname=https://auth.tilia-inc.com/authorize?response_type=code&client_id=2f7ac0c0-d169-42bf-9d0f-a45abbc72ee8&redirect_uri=https://community.secondlife.com/&scope=user_info persona_info sl_resident_info&state=2krhni6eskui8j5r6cmvgnnqgu

[Gabriele Graves]

Possibly related to this:

https://bugzilla.mozilla.org/show_bug.cgi?id=1910322

Reddit discussion here:

 

[bigmoe Whitfield]

18 minutes ago, Gabriele Graves said:

Possibly related to this:

https://bugzilla.mozilla.org/show_bug.cgi?id=1910322

Reddit discussion here:

 

well since I checked the certificate and it was valid, I would say it's not revoked, the site would of showed revoked.

[Quistess Alpha]

33 minutes ago, bigmoe Whitfield said:

well since I checked the certificate and it was valid, I would say it's not revoked, the site would of showed revoked.

I'm not really up on web stuff, but this OCSP checker says revoked: https://certificatetools.com/ocsp-checker?optradio=download (paste in full link: https://auth.tilia-inc.com/authorize )

[animats]

More info:

• DigiCert statement: https://www.digicert.com/support/certificate-revocation-incident
• Litigation: https://www.courtlistener.com/docket/68995396/alegeus-technologies-llc-v-digicert/

This should have been fixed before users noticed. Tilia just took a hit on reputation.

[bigmoe Whitfield]

Chrome is telling me that.   I'm so confused,  firefox goes "no"  the cert checker I use say's yes...  chrome say's yes...     somebody else posted it's revoked.   scratching my head here.

[animats]

11 hours ago, bigmoe Whitfield said:

I'm so confused,

Certificate revocation works by putting a certificate on a public blacklist. Some browsers check the blacklist. Some don't. It's an option in Firefox. Under Firefox Settings, see

Certificates
    Query OCSP responder servers to confirm the current validity of certificates

If that setting is turned on for Firefox, and you try https://auth.tilia-inc.com/  you get

Secure Connection Failed

An error occurred during a connection to auth.tilia-inc.com. Peer’s Certificate has been revoked.

Error code: SEC_ERROR_REVOKED_CERTIFICATE

• The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
• Please contact the website owners to inform them of this problem.

 

So that's what it looks like in a browser with revocation checking turned on.

(This has been broken for several days now. Linden Lab is now in the position of merely being a customer of Thunes, and doesn't control the systems involved. Maybe all LL can do is file a support ticket. There are many players involved: Tilia, Thunes, CSC Corporate Domains, DigiCert, and Linden Lab's legal department, who is still the official contact point for this domain. )

[Love Zhaoying]

2 minutes ago, animats said:

Certificate revocation works by putting a certificate on a public blacklist. Some browsers check the blacklist. Some don't. It's an option in Firefox. Under Firefox Settings, see

Certificates
    Query OCSP responder servers to confirm the current validity of certificates

If that setting is turned on for Firefox, and you try https://auth.tilia-inc.com/  you get

Secure Connection Failed

An error occurred during a connection to auth.tilia-inc.com. Peer’s Certificate has been revoked.

Error code: SEC_ERROR_REVOKED_CERTIFICATE

• The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
• Please contact the website owners to inform them of this problem.

 

So that's what it looks like in a browser with revocation checking turned on.

(This has been broken for several days now. Linden Lab is now in the position of merely being a customer of Thunes, and doesn't control the systems involved. Maybe all LL can do is file a support ticket. There are many players involved: Tilia, Thunes, CSC Corporate Domains, DigiCert, and Linden Lab's legal department, who is still the official contact point for this domain. )

Can mischief-makers purposefully get a cert blacklisted?

[Quistess Alpha]

Seems it's been fixed; took long enough. . .

[animats]

3 hours ago, Quistess Alpha said:

Seems it's been fixed; took long enough. . .

Yes. A new certificate for "*.tilia-inc.com" was generated Tue, 06 Aug 2024 18:40:19 GMT. Valid until Tue, 21 Jan 2025 23:59:59 GMT.

[Kathrine Jansma]

On 8/6/2024 at 7:19 PM, Love Zhaoying said:

Can mischief-makers purposefully get a cert blacklisted?

Not easily. You would need to find a misbehaviour that leads to the certificate being blacklisted due to the CAs policy.

But you can rather easily Denial-of-Service the OCSP responder (see https://www.imperialviolet.org/2014/04/19/revchecking.html ).

Thats a reason OCSP stapling was invented. And another reason that browser are planning to remove mandatory OCSP support (in addition to the privacy issues with OCSP).

See for example:

https://letsencrypt.org/2024/07/23/replacing-ocsp-with-crls.html

[beethros Karas]

I dkn about you..
But this thing made me feel secure, or else said, protected, by using firefox!
Cudos to Firefox!