0

Currently, when I try to access www.comic-rocket.com on my iPad (iOS 10.2), the site will not load.

  • Safari simply won't load the page, as if I hadn't even tried to do so.
  • Chrome and Dolphin will show a "ERR_CERTIFICATE_INVALID" error message. Chrome details it as having received a scrambled certificate.

The issue does not occur on Windows, on Android, or on a friend's iPhone, i.e. it seems to be uniquely tied to my specific device. Update: On a colleagues iPad Pro I can finally reproduce the issue. Probably my friends don't have the latest iOS installed, where StartCom should be removed as valid certificate authority, see jksoegaard's answer.

Is there some way I may solve this, short of fully resetting the device?

I already tried:

  • Hard-Reset of the device (holding power- and home-button until the device restarts).
  • Resetting network settings
  • Resetting "All Settings"
  • Downloading the certificate on Windows, mailing it myself and installing it from the "Mail" app (doesn't work from Gmail).1
  • In a related thread2, deleting everything under "Settings > General > Profiles" (may be called "Device management" instead of "Profiles") was suggested. This entry however didn't even exist until I installed the certificate manually (i.e. there was nothing do delete).

Footnotes

1 In order to download the correct certificate, I had to disable my Antivirus temporarily, since it injects its own root certificate. Using "SSL Detective" on iOS, I checked that the certificates received by the iPad and by Chrome on Windows match. 2 Certificate error when using Chrome for iOS with company CA

Improve this question

1 Answer 1

Reset to default
2

Your certificate is issued by StartCom. The company has recently endured a number of scandals where they broke the rules governing certificates.

This means that for example new versions of Firefox does not trust StartCom certificates issued after the 21st of October 2016. Your certificate is from 2017.

Your problems are probably caused by this. The iPad likely has newer software/certificate updates than your Windows or Android device.

In time expect that no one will accept your StartCom certificate.

I suggest replacing the certificate with a new certificate!

Improve this answer
4
  • Thankfully I'm only a user of the server, though that also means that I can't change the certificate. Also, my Firefox installation is updated and will happily load comic-rocket.com. At least though it gives me hope, that the issue isn't client-side, and will be fixed server-side as the issue becomes more widespread.
    – kdb
    Jan 9, 2017 at 12:43
  • I just checked Firefox again. It is version 50.0.1, and the blog post says that the root certificates will be removed in 51.x.
    – kdb
    Jan 9, 2017 at 12:49
  • Yes, and for Chrome it is version 56 that starts distrusting them. Apple has also removed them from the trust store on macOS (see support.apple.com/en-us/HT202858) - probably they did the same thing on iOS already.
    – jksoegaard
    Jan 9, 2017 at 13:02
  • After reading you answer, I asked a colleague to let me try on his iPad, which I verified to have iOS 10.2 installed, and it showed the same behaviour as for me. I have now tried to contact the site-owner.
    – kdb
    Jan 9, 2017 at 13:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .