0

I'm trying to access https://www.torrentz.com through the Tor Browser Bundle, but I get the "connection not secure" warning. TBB says the issuer certificate is unknown. I can access the site just fine through Firefox, which says the site is verified by COMODO CA Limited.

What's going on here? Is something wrong with the Tor Browser, or is there a reason it doesn't trust Comodo CA?

Improve this question
2
  • I'm voting to close this question as off-topic because it is about TLS and certificates. I'd recommend to ask such questions in security.stackexchange.com
    – Jens Kubieziel ♦
    Apr 21, 2017 at 11:14
  • This question was answered a year ago, and it was specific to the Tor Browser, because the same error did not happen in regular versions of Firefox.
    – SuperSluether
    Apr 21, 2017 at 15:34

1 Answer 1

Reset to default
1

This is likely unrelated to Tor Browser (except that Tor Browser is being more strict about TLS being properly configured on the server side, it seems...), the server itself is at fault, the administrator has failed to configure TLS correctly.

It is missing an intermediate certificate to complete the "trust" chain between it's certificate and a trusted anchor, therefor Tor Browser cannot work back to a trusted anchor to ensure that it has been issued by a CA it trusts.

e.g.

  • COMODO has a root certificate A.

  • COMODO (or some bored student from Iran...) signs an intermediate certificate B, this allows them to keep the root of their trust, A, offline and safe. If B is compromised it is easier to revoke and replace than A.

  • COMODO signs your TLS certificate, C, with B.

  • The server, however, is only issuing C and the browser has no indication that B exists, it cannot find a link to A. The server should issue both C and B so your browser can find C->B->A and know that A issued C.

See the Qualys SSL Labs report for www.torrentz.com.

This server's certificate chain is incomplete. Grade capped to B.

Improve this answer
2
  • Interesting how Firefox didn't have an issue with it. At any rate, torrentz.eu provides the exact same info without errors.
    – SuperSluether
    Jul 21, 2016 at 14:03
  • 1
    @SuperSluether actually they don't provide the same information, you can test this youself by performing openssl s_client -showcerts -connect www.torrentz.com:443 and then also for www.torrentz.eu:443. You'll notice that torrentz.eu actually provides 3 certificates, being the certificate itself and the requried intermediaries while torrentz.com provides only one certificate. This is the source of the errors. Output here: paste.debian.net/hidden/8805977a
    – cacahuatl
    Jul 23, 2016 at 22:31

Not the answer you're looking for? Browse other questions tagged .