0

I'm trying to access https://www.torrentz.com through the Tor Browser Bundle, but I get the "connection not secure" warning. TBB says the issuer certificate is unknown. I can access the site just fine through Firefox, which says the site is verified by COMODO CA Limited.

What's going on here? Is something wrong with the Tor Browser, or is there a reason it doesn't trust Comodo CA?

closed as off-topic by Jens Kubieziel Apr 21 '17 at 11:14

  • This question does not appear to be about Tor, within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • I'm voting to close this question as off-topic because it is about TLS and certificates. I'd recommend to ask such questions in security.stackexchange.com – Jens Kubieziel Apr 21 '17 at 11:14
  • This question was answered a year ago, and it was specific to the Tor Browser, because the same error did not happen in regular versions of Firefox. – SuperSluether Apr 21 '17 at 15:34
1

This is likely unrelated to Tor Browser (except that Tor Browser is being more strict about TLS being properly configured on the server side, it seems...), the server itself is at fault, the administrator has failed to configure TLS correctly.

It is missing an intermediate certificate to complete the "trust" chain between it's certificate and a trusted anchor, therefor Tor Browser cannot work back to a trusted anchor to ensure that it has been issued by a CA it trusts.

e.g.

  • COMODO has a root certificate A.

  • COMODO (or some bored student from Iran...) signs an intermediate certificate B, this allows them to keep the root of their trust, A, offline and safe. If B is compromised it is easier to revoke and replace than A.

  • COMODO signs your TLS certificate, C, with B.

  • The server, however, is only issuing C and the browser has no indication that B exists, it cannot find a link to A. The server should issue both C and B so your browser can find C->B->A and know that A issued C.

See the Qualys SSL Labs report for www.torrentz.com.

This server's certificate chain is incomplete. Grade capped to B.

  • Interesting how Firefox didn't have an issue with it. At any rate, torrentz.eu provides the exact same info without errors. – SuperSluether Jul 21 '16 at 14:03
  • 1
    @SuperSluether actually they don't provide the same information, you can test this youself by performing openssl s_client -showcerts -connect www.torrentz.com:443 and then also for www.torrentz.eu:443. You'll notice that torrentz.eu actually provides 3 certificates, being the certificate itself and the requried intermediaries while torrentz.com provides only one certificate. This is the source of the errors. Output here: paste.debian.net/hidden/8805977a – cacahuatl Jul 23 '16 at 22:31

Not the answer you're looking for? Browse other questions tagged or ask your own question.