algorithm - www.googleadservices.com 使用了无效的安全证书

Question

www.googleadservices.com 使用了无效的安全证书。 www.googleadservices.com 显示以下问题:

The certificate was signed using a signature algorithm that is disabled because it is not secure.

HTTP Strict Transport Security: false

HTTP Public Key Pinning: true

请帮忙

Answer 1

您的客户端似乎配置错​​误并生成虚假消息。或者，您的连接被拦截并且代理正在使用弱/受伤的算法。配置错误和过时的 TLS 代理是一个已知问题。另请参阅 Jarmoc 的 BlackHat 谈话 SSL Interception Proxies and Transitive Trust。

这是我对 www.googleadservices.com 的看法。据我所知，今天的标准可以接受 RSA-2048 和 SHA-256:

$ openssl s_client -connect www.googleadservices.com:443 -servername www.googleadservices.com -tls1 | openssl x509 -text -noout
depth=3 C = US, O = Equifax, OU = Equifax Secure Certificate Authority
verify return:1
depth=2 C = US, O = GeoTrust Inc., CN = GeoTrust Global CA
verify return:1
depth=1 C = US, O = Google Inc, CN = Google Internet Authority G2
verify return:1
depth=0 C = US, ST = California, L = Mountain View, O = Google Inc, CN = www.googleadservices.com
verify return:1
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 294569083916079532 (0x416850568a151ac)
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=US, O=Google Inc, CN=Google Internet Authority G2
        Validity
            Not Before: Jan 25 10:41:05 2017 GMT
            Not After : Apr 19 10:09:00 2017 GMT
        Subject: C=US, ST=California, L=Mountain View, O=Google Inc, CN=www.googleadservices.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:a2:85:55:c4:95:3d:38:30:8f:75:cc:b2:55:59:
                    9f:9b:6f:e5:07:92:48:e7:c9:4e:3c:9c:4a:b6:a4:
                    2f:05:1e:6f:8e:61:0d:85:bb:6e:be:8a:a9:27:66:
                    e9:31:da:ec:2a:29:8f:b5:11:05:fb:b8:d6:53:c1:
                    80:f4:f7:75:68:e0:46:5e:3d:9b:64:7c:26:98:95:
                    91:d8:e2:c7:8e:12:6b:58:24:70:9c:04:b7:da:f3:
                    6e:ed:a1:a0:c1:ad:32:6a:62:e7:91:8d:84:48:c9:
                    16:a8:49:e1:a7:bd:18:3e:fa:85:be:84:67:b4:c1:
                    28:24:94:d8:76:f3:fe:ac:e4:09:55:f0:42:49:97:
                    2d:3e:f5:c8:41:5d:67:c6:7d:4f:7f:56:80:1f:e9:
                    3e:fe:90:83:89:8c:9a:db:be:6c:60:b2:64:08:d0:
                    d9:c0:01:1a:a5:15:28:dc:89:39:52:94:b2:12:a7:
                    b4:ff:6b:56:56:a9:38:bb:34:4a:cc:9e:9a:57:29:
                    d1:bc:21:46:84:0d:3d:08:23:6f:27:e5:c9:4d:81:
                    e2:e9:b4:b0:05:b4:35:bd:73:13:cc:4b:db:78:51:
                    bb:85:f9:6f:18:38:cd:2b:55:cf:2a:5b:7c:17:de:
                    c1:e5:40:4c:7f:d5:8d:09:dd:c4:86:49:a3:92:ea:
                    39:a1
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Alternative Name:
                DNS:www.googleadservices.com
            Authority Information Access:
                CA Issuers - URI:http://pki.google.com/GIAG2.crt
                OCSP - URI:http://clients1.google.com/ocsp

            X509v3 Subject Key Identifier:
                F4:A4:33:19:C3:E0:AB:5C:C9:53:90:26:7E:AB:4E:CB:B3:99:1C:59
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Authority Key Identifier:
                keyid:4A:DD:06:16:1B:BC:F6:68:B5:76:F5:81:B6:BB:62:1A:BA:5A:81:2F

            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.11129.2.5.1
                Policy: 2.23.140.1.2.2

            X509v3 CRL Distribution Points:

                Full Name:
                  URI:http://pki.google.com/GIAG2.crl

    Signature Algorithm: sha256WithRSAEncryption
         53:db:ed:18:e3:47:b7:6d:a7:7d:5a:e1:d0:ce:be:af:48:79:
         ea:1b:d4:22:64:1e:73:2d:5f:24:b2:34:e7:d8:7d:fd:f5:22:
         1d:e7:5b:32:3c:f6:d2:59:87:9c:35:8b:95:5f:74:69:c7:d0:
         94:1e:ce:09:de:1c:f8:48:a4:25:5b:6b:36:d6:15:87:90:2c:
         a8:84:26:65:cc:fb:33:05:ba:90:dc:a0:58:00:cc:1d:b1:6b:
         ed:6c:dd:e7:83:cd:bd:6c:27:ee:0e:cc:11:00:b1:49:f9:4c:
         59:6e:50:15:b0:22:9f:31:ac:10:f4:dc:14:d2:5a:be:6d:47:
         f5:fd:c8:d8:bd:ff:3a:de:29:dd:a9:ac:fa:5b:63:cc:ee:50:
         b6:25:5e:b5:4a:c1:fa:c2:bb:c8:f2:33:e5:92:b9:ec:18:13:
         2f:0b:70:86:6b:f6:94:15:ec:53:ed:af:52:2f:3e:06:9a:8d:
         b5:80:a5:bc:b5:b3:56:92:a8:1b:c6:d1:cd:49:b4:04:65:b4:
         be:9a:56:1c:e9:17:84:54:24:85:c4:07:ce:4e:dd:0b:f6:8d:
         53:54:66:90:7f:36:77:3e:8f:40:79:79:73:75:d1:66:bd:b2:
         41:ee:5f:d2:4f:e2:fa:78:c1:3d:e4:ff:a4:ae:7a:94:81:af:
         d2:6a:60:2b