2

I don't know where to dig in to solve this. Hope for some advice

Today suddenly soundcloud.com stopped working, with error "The certificate has and invalide issuer". The issue persists across all browsers. and only on my Mac(10.12) machine.

Here are the errors I am getting

enter image description here

Here it says certificate has been revoked

enter image description here

Any idea what happened? I am getting paranoid already :)

EDIT:
I tried to clean cache sudo rm /var/db/crls/*cache.db, that didn't help

Alex Reds
  • 123
  • 5

3 Answers3

3

From their twitter : https://twitter.com/globalsign/status/786505261842247680

"We are currently experiencing issues with our OCSP which is causing certificate warning messages. We aim to fix this as soon as possible."

The OCSP is the certificate status protocol - their server is potentially flagging certificates as revoked when they are not supposed to be. This would be a big issue for them, but from follow up tweets, it appears they may have this resolved.

The OCSP status info may be cached for awhile, though, so it may be awhile before certificate errors go away.

crovers
  • 6,381
  • 1
  • 20
  • 30
  • Ah, thank you so much for this info! I tried to google the problem but search did not return anything like that. Weird that this problem touched only my computer on the network. Rest computers and devices are able to access site with no problems. And that started some dodgy thoughts crawl into my mind)) – Alex Reds Oct 13 '16 at 15:45
  • You may have just gotten 'lucky' in your timing - got the invalid response on your computer, but it was fixed by the time you moved to other machines. A possibility, anyways – crovers Oct 13 '16 at 15:50
3

I have just spoken to Globalsign and it is not resolved yet but their engineers in Japan are still working on it.

They say they revoked an old root certificate as part of their life cycle which shouldn't have affected any current certificates but it has. They don't know when it will be fixed but plan to work around the clock.

Even when it is fixed they will need to ensure their CDN partners are updated and en users will need to clear their caches.

Sean Whestone
  • 31
  • 1
0

If you're still experiencing this issue, reset your OSCP and CRL cache. That fixed the issue for me.

macOS, up to 10.11

sudo rm /var/db/crls/*cache.db

macOS 10.12 (Sierra)

sqlite3 ~/Library/Keychains/*/ocspcache.sqlite3 'DELETE FROM ocsp;'

Arno
  • 116