www.googleadservices.com utilise un certificat de sécurité invalide

Question

www.googleadservices.com utilise un certificat de sécurité invalide. www.googleadservices.com indique le numéro suivant:

Le certificat a été signé à l'aide d'un algorithme de signature désactivé car non sécurisé.

HTTP Strict Sécurité Transport: false

HTTP clé publique épinglage: true

S'il vous plaît aider

Answer 1

Votre client semble être mal configuré et afficher de faux messages. Ou, votre connexion est interceptée et le proxy utilise des algorithmes faibles/blessés. Les proxies TLS mal configurés et obsolètes sont un problème connu. Voir également le discours Blackarm de Jarmoc SSL Interception Proxies and Transitive Trust.

Voici ma vue de www.googleadservices.com. Pour autant que je sache, à la fois RSA-2048 et SHA-256 sont acceptables selon les normes d'aujourd'hui:

$ openssl s_client -connect www.googleadservices.com:443 -servername www.googleadservices.com -tls1 | openssl x509 -text -noout 
depth=3 C = US, O = Equifax, OU = Equifax Secure Certificate Authority 
verify return:1 
depth=2 C = US, O = GeoTrust Inc., CN = GeoTrust Global CA 
verify return:1 
depth=1 C = US, O = Google Inc, CN = Google Internet Authority G2 
verify return:1 
depth=0 C = US, ST = California, L = Mountain View, O = Google Inc, CN = www.googleadservices.com 
verify return:1 
Certificate: 
    Data: 
     Version: 3 (0x2) 
     Serial Number: 294569083916079532 (0x416850568a151ac) 
    Signature Algorithm: sha256WithRSAEncryption 
     Issuer: C=US, O=Google Inc, CN=Google Internet Authority G2 
     Validity 
      Not Before: Jan 25 10:41:05 2017 GMT 
      Not After : Apr 19 10:09:00 2017 GMT 
     Subject: C=US, ST=California, L=Mountain View, O=Google Inc, CN=www.googleadservices.com 
     Subject Public Key Info: 
      Public Key Algorithm: rsaEncryption 
       Public-Key: (2048 bit) 
       Modulus: 
        00:a2:85:55:c4:95:3d:38:30:8f:75:cc:b2:55:59: 
        9f:9b:6f:e5:07:92:48:e7:c9:4e:3c:9c:4a:b6:a4: 
        2f:05:1e:6f:8e:61:0d:85:bb:6e:be:8a:a9:27:66: 
        e9:31:da:ec:2a:29:8f:b5:11:05:fb:b8:d6:53:c1: 
        80:f4:f7:75:68:e0:46:5e:3d:9b:64:7c:26:98:95: 
        91:d8:e2:c7:8e:12:6b:58:24:70:9c:04:b7:da:f3: 
        6e:ed:a1:a0:c1:ad:32:6a:62:e7:91:8d:84:48:c9: 
        16:a8:49:e1:a7:bd:18:3e:fa:85:be:84:67:b4:c1: 
        28:24:94:d8:76:f3:fe:ac:e4:09:55:f0:42:49:97: 
        2d:3e:f5:c8:41:5d:67:c6:7d:4f:7f:56:80:1f:e9: 
        3e:fe:90:83:89:8c:9a:db:be:6c:60:b2:64:08:d0: 
        d9:c0:01:1a:a5:15:28:dc:89:39:52:94:b2:12:a7: 
        b4:ff:6b:56:56:a9:38:bb:34:4a:cc:9e:9a:57:29: 
        d1:bc:21:46:84:0d:3d:08:23:6f:27:e5:c9:4d:81: 
        e2:e9:b4:b0:05:b4:35:bd:73:13:cc:4b:db:78:51: 
        bb:85:f9:6f:18:38:cd:2b:55:cf:2a:5b:7c:17:de: 
        c1:e5:40:4c:7f:d5:8d:09:dd:c4:86:49:a3:92:ea: 
        39:a1 
       Exponent: 65537 (0x10001) 
     X509v3 extensions: 
      X509v3 Extended Key Usage: 
       TLS Web Server Authentication, TLS Web Client Authentication 
      X509v3 Subject Alternative Name: 
       DNS:www.googleadservices.com 
      Authority Information Access: 
       CA Issuers - URI:http://pki.google.com/GIAG2.crt 
       OCSP - URI:http://clients1.google.com/ocsp 

      X509v3 Subject Key Identifier: 
       F4:A4:33:19:C3:E0:AB:5C:C9:53:90:26:7E:AB:4E:CB:B3:99:1C:59 
      X509v3 Basic Constraints: critical 
       CA:FALSE 
      X509v3 Authority Key Identifier: 
       keyid:4A:DD:06:16:1B:BC:F6:68:B5:76:F5:81:B6:BB:62:1A:BA:5A:81:2F 

      X509v3 Certificate Policies: 
       Policy: 1.3.6.1.4.1.11129.2.5.1 
       Policy: 2.23.140.1.2.2 

      X509v3 CRL Distribution Points: 

       Full Name: 
        URI:http://pki.google.com/GIAG2.crl 

    Signature Algorithm: sha256WithRSAEncryption 
     53:db:ed:18:e3:47:b7:6d:a7:7d:5a:e1:d0:ce:be:af:48:79: 
     ea:1b:d4:22:64:1e:73:2d:5f:24:b2:34:e7:d8:7d:fd:f5:22: 
     1d:e7:5b:32:3c:f6:d2:59:87:9c:35:8b:95:5f:74:69:c7:d0: 
     94:1e:ce:09:de:1c:f8:48:a4:25:5b:6b:36:d6:15:87:90:2c: 
     a8:84:26:65:cc:fb:33:05:ba:90:dc:a0:58:00:cc:1d:b1:6b: 
     ed:6c:dd:e7:83:cd:bd:6c:27:ee:0e:cc:11:00:b1:49:f9:4c: 
     59:6e:50:15:b0:22:9f:31:ac:10:f4:dc:14:d2:5a:be:6d:47: 
     f5:fd:c8:d8:bd:ff:3a:de:29:dd:a9:ac:fa:5b:63:cc:ee:50: 
     b6:25:5e:b5:4a:c1:fa:c2:bb:c8:f2:33:e5:92:b9:ec:18:13: 
     2f:0b:70:86:6b:f6:94:15:ec:53:ed:af:52:2f:3e:06:9a:8d: 
     b5:80:a5:bc:b5:b3:56:92:a8:1b:c6:d1:cd:49:b4:04:65:b4: 
     be:9a:56:1c:e9:17:84:54:24:85:c4:07:ce:4e:dd:0b:f6:8d: 
     53:54:66:90:7f:36:77:3e:8f:40:79:79:73:75:d1:66:bd:b2: 
     41:ee:5f:d2:4f:e2:fa:78:c1:3d:e4:ff:a4:ae:7a:94:81:af: 
     d2:6a:60:2b