[Phoeniyx]

Hey guys. Got a new Z10 and noticed that a particular website (York University) link has a certificate which cannot be verified by the BB10 browser. The same site has no issues with Chrome, Firefox, and IE (with the default root certificates). The link is:
https://wrem.sis.yorku.ca/Apps/WebOb...=GradeReportv1

On the desktop browsers, this redirects to the screen where you enter the user credentials - before getting redirected back without any issues. On the BB10 browser, there is a warning saying cert cannot be verified as soon as you go to the link. Can someone please tell me why this is? The root cert of link above seems to be COMODO High-Assurance Secure Server CA.

Btw, another way to find link is (easier to type in BB10):
1) http://www.yorku.ca/yorkweb/cs.htm
2) click on Grade Reports FW link

Thanks.

[tgzgeorge]

Do this and add exception to the site.




Posted via CB10

[jbaker8]

I'm not very tech savvy but I've had similar issues with my job's website. If you click "Add Exception" the Web page opens. This generally saves the info so next time you should be able for open the site automatically.

Posted via CB10

[tgzgeorge]

Expand to continue then add exception, tap I understand the risks.




Posted via CB10

[Phoeniyx]

Hey guys. I suppose I should have made it more clear in my original question.. I am not asking for a way to bypass this issue. Adding an exception in this case (and similar cases) is an obvious security risk. Anyone can phish a website, present a false cert, and get an unsophisticated user to accept the "fake" certificate. Now that the "fake" cert is added to your cert store, the real fun can begin (for the hacker, and certainly not for the user).

My question was more related to WHY this happens in the first place, when the same security issue does not happen on the desktop browsers. Is the root cert "COMODO High-Assurance Secure Server CA." not part of the BB10 browser? Or does the website take a different path for BB10?

Thanks!

[drcrane]

Common issue... intermediate cert is not installed correctly, run site through SSL Checker ... first I found on Google was http://www.sslshopper.com/ssl-checke...m.sis.yorku.ca

Contact York if you want it fixed.

The reason it works in your desktop browser is because you browsed a site using the same certificate authority and your browser cached the intermediate cert from there or your desktop browser includes the intermediate cert already.

Now that everyone and their grandmother can run a CA certs really aren't all that they're cracked up to be...


Posted via CB10

[Phoeniyx]

Thanks buddy. Will do.