Bitcoin Forum

Anyone else getting a "certificate has been revoked" message when they visit https://www.dwolla.com (https://www.dwolla.com) ?

http://i47.tinypic.com/aljfb7.png

yep

Not getting that warning on my end, using Chrome.  Certificate signed by VeriSign, and valid thru June 2013.

Hmm. I'm in Washington State, U.S.A., it seems fine here. Using Chrome on Windows 7.

Only on Firefox

"Peer's Certificate has been revoked."

I'm getting the error here on Chrome(latest version and proper fucking settings  :-* )  win 7 64  and on IE9 and in Firefox 14.01;

Secure Connection Failed
        
          An error occurred during a connection to www.dwolla.com.

Peer's Certificate has been revoked.

(Error code: sec_error_revoked_certificate)

I'm getting revoked certificate on FireFox & Opera.

Looks like some versions of Chrome no longer check revoked SSL certificates:

https://www.computerworld.com/s/article/9224078/Google_Chrome_will_no_longer_check_for_revoked_SSL_certificates_online (https://www.computerworld.com/s/article/9224078/Google_Chrome_will_no_longer_check_for_revoked_SSL_certificates_online)

aye, it does not check revokes in real time any more, but should update the list of revokes if you have the updates on in Chrome..

strange there is nothing popping up on google about it. Anyone check the CA server, etc? Is it a fluke or Dwolla being hacked or what?

Yes verified on Firefox 14.01 (Ubuntu 12.04)
IE 9 (Windows 7)
GNOME Web Browser 2.22.2 (gNewSense 2.3)

From Symantic/Verisign:

www.dwolla.com is successfully secured by an SSL certificate. The following certificates are correctly installed:
 ------Certificate 1------ --Issued To-- Organization: Dwolla Corp. Organizational Unit: Terms of use at www.verisign.com/rpa (c)05 Organizational Unit 2: Online Services Common Name: www.dwolla.com Locale: Des Moines, Iowa Country: US  --Issued By-- Organization: VeriSign,, Inc. Organizational Unit: Terms of use at https://www.verisign.com/rpa (c)06 Organizational Unit 2: VeriSign Trust Network Common Name: VeriSign Class 3 Extended Validation SSL SGC CA Country: US  Valid from Mon Jun 20 20:00:00 EDT 2011 to Thu Jun 20 19:59:59 EDT 2013 Serial Number (hex): 2b2cb56f093c54a0f949376955ebc220 -------------------------  -
-----Certificate 2------ --Issued To-- Organization: VeriSign,, Inc. Organizational Unit: Terms of use at https://www.verisign.com/rpa (c)06 Organizational Unit 2: VeriSign Trust Network Common Name: VeriSign Class 3 Extended Validation SSL SGC CA Country: US  --Issued By-- Organization: VeriSign,, Inc. Organizational Unit: (c) 2006 VeriSign,, Inc. - For authorized use only Organizational Unit 2: VeriSign Trust Network Common Name: VeriSign Class 3 Public Primary Certification Authority - G5 Country: US  Valid from Tue Nov 07 19:00:00 EST 2006 to Mon Nov 07 18:59:59 EST 2016 Serial Number (hex): 2c48dd930df5598ef93c99547a60ed43 -------------------------
 ------Certificate 3------ --Issued To-- Organization: VeriSign,, Inc. Organizational Unit: (c) 2006 VeriSign,, Inc. - For authorized use only Organizational Unit 2: VeriSign Trust Network Common Name: VeriSign Class 3 Public Primary Certification Authority - G5 Country: US  --Issued By-- Organization: VeriSign,, Inc. Organizational Unit: Class 3 Public Primary Certification Authority Country: US  Valid from Tue Nov 07 19:00:00 EST 2006 to Sun Nov 07 18:59:59 EST 2021 Serial Number (hex): 250ce8e030612e9f2b89f7054d7cf8fd ------------------------- 


On another note...
"Dwolla.com wants to track your physical location."

... That's new for me.

I was literally just about to get around to deleting my account. It was the first time I visited the page in months. They sensed it.

Sounds like the "disruptor" is getting disrupted. :P

Dwolla hasn't commented on Twitter either, their last comment was about 1 hour ago.

Could it just be that the OCSP server is down and not able to check it?  Not sure what OCSP servers there are or whether your browser has predefined ones it would sue or the site would point to one though....

No, because an OCSP error is usually a softfail, and will be noted as OCSP unreachable. This error means that specific action has been taken to revoke the certificate.

Wonder if a hacker broke in.

rgr.

Since Symantic/Verisign list Dwolla has having a valid cert, what is the cert that is getting check and reporting as being revoked? Anyone able to grab the cert that is there now?

That's what's confusing me; I manually downloaded the most recent CRL and I couldn't find Dwolla's serial number in there. I don't know if it's possible for "just anyone" to revoke a certificate; I was under the impression that the issuer had to do so. The CRL distribution point should be http://evintl-crl.verisign.com/EVIntlT1.crl (I think). EDIT: It's http://EVIntl-crl.verisign.com/EVIntl2006.crl

Verisign shows it as revoked; https://securitycenter.verisign.com/celp/enroll/searchCertDetails?issuerSerial=027604bed5c781846325897410d66ecc&application_locale=VRSN_US

Link doesn't work for me; Serial that I have is ‎2b 2c b5 6f 09 3c 54 a0 f9 49 37 69 55 eb c2 20 ???

link works OK;

Verify Certificate Common Name:   www.dwolla.com 
Status:   Revoked 
Validity (GMT):   Jun 21, 2011 - Jun 20, 2013 
Class:   Digital ID Class 3 - Extended Validation SGC FreeReplacement 
Organization:   Dwolla Corp. 
Organizational Unit:   Online Services
Terms of use at www.verisign.com/rpa (c)05
 
State:   Iowa 
City/Location:   Des Moines 
Country:   US 
Serial Number:   2b2cb56f093c54a0f949376955ebc220 
Issuer Digest:   027604bed5c781846325897410d66ecc 

Looks like they are already on it. New entry just appeared;

Verify Certificate Common Name:   www.dwolla.com  
Status:   Pending Renewal  
Validity (GMT):   Jul 22, 2012 - Jul 22, 2014  
Class:   Digital ID Class 3 - Extended Validation SGC Renewal  
Organization:   Dwolla Corp.  
Organizational Unit:   Online Services
Terms of use at www.verisign.com/rpa (c)05
 
State:   Iowa  
City/Location:   Des Moines  
Country:   US  
Serial Number:   2c34739c28b93ac00ea3009662affcff  
Issuer Digest:   0d0a7f5229e7dacc9b3bbfb77bb9fc6a  

Continue session
Error
Due to inactivity and for security reasons, your user session has timed out. Click Continue to go to the VeriSign home page.

   

ahh, did not see the session ID on my end. hehe.

Just put www.dwolla.com in the search here;
https://securitycenter.verisign.com/celp/enroll/searchCertDetails?

System Unavailable

The system is currently not available. Please retry your request later.

 :P ;D
I'm guessing you have a login somewhere?

bastards ;p

https://securitycenter.verisign.com/celp/enroll/outsideSearch?application_locale=VRSN_US

Dwolla on Twitter (23 minutes ago):

"Working with our partners at @verisign and @symantec to look into a certificate issue some of our users are reporting. Still secure.

Edit: Linky www.twitter.com/dwolla/status/226882115516653568

I wonder if someone manged to guess their passphrase on verisign and hit revoke on it? Seems unlikely, but otherwise this is some really strange 'issue'..


Anyone with a cert of there own able to verify that just hitting 'options' and then entering your passphrase will give one the option to revoke from there on Verisign?

Same message here on my Firefox

sec_error_revoked_certificate

 :-\

The issue is still there. According to Firefox, the certificate has been revoked. According to Android browser, it is valid, and the page loads. Doesn't Android check for revoked certificates?!

I wonder if this is having any effect on pirateat40's business model.  ;D

 WWW.DWOLLA.COM     Pending Renewal   Digital ID Class 3 - Extended Validation SGC Renewal   Jul 22, 2012 to Jul 22, 2014 
  WWW.DWOLLA.COM     Revoked   Digital ID Class 3 - Extended Validation SGC Renewal   Jun 21, 2011 to Jun 6, 2013 
  WWW.DWOLLA.COM     Revoked   Digital ID Class 3 - Extended Validation SGC FreeReplacement   Jun 21, 2011 to Jun 20, 2013 


I'm assuming from the 'free replacement' that is listed this happened to them before.  Their new one is still pending.

Looks like it is working now with a GoDaddy Class 2 cert. Probably a temporary fix until they get their green-bar cert working again.

Call me a conspiracy theorist, but I believe this is The Powers That Be (TPTB) using their influence at Verisign to interfere with bitcoin.

A few months ago, I have had similar problems with Firefox telling me that the certificates were not valid on the Intersango, Mt Gox, and btc-e.com.

Even today, my android phone will not let me use MtGox Mobile app due to some problem with the certificate.

IMO TPTB use certificates authorities and anti-virus software like Norton to implement a casual form of website blacklisting.

This is why we need to develop the DarkNet real freaking quick.

Ridiculous.  When "TPTB" start giving a shit about Bitcoin, they won't interfere with some passive-aggressive certificate revocation scheme.  They'll come at it with guns blazing.

not to mention isn't bitcoin only a small part of Dwolla's business?  It is still possible someone has it out for Dwolla but who that may be is anyones guess.

Stay calm, here is the solution about the certificates problem http://perspectives-project.org/

how does one know they can trust the 'network notary' server? It seems like one more point of potential breach to me to bypass the CA's and then rely on yet another place for verification of SSL certs. Granted I did not read through to see how they address the trust issue.

I think this quote clears it out...

Because the user chooses that notary themselves.

yea, that does not quite cut it though. It's not like choosing your partner or something that you know all about. How is the list made to choose from? What verifies that the list is trustworthy natoaries? I'd assume this service decides that list, and if so does not do anything to reduce any trust issues with just using the standard CA's. It instead would increase trust issues unless there is some really indepth method for listing trusted notaries.

So, does anyone know why the certificate was revoked by verisign? It seems like this caught dwolla by surprise.

Just a note, it seems that Dwolla switched to GoDaddy (known to be more trustworthy than Verisign?).

Dwolla, before:
https://i.imgur.com/B3v00.png

Dwolla, after:
https://i.imgur.com/iDeZu.png

Who owns GoDaddy?

According to Wikipedia (http://en.wikipedia.org/wiki/Go_Daddy) it's owned by KKR, Silver Lake Partners and Technology Crossover Ventures.

That explains how stuxnet got into Iran. A Massad agent is CEO of 3 domain name registration companies, GoDaddy is just one.

This change in domains smells like manipulation/backroom deal shennanigans.

Bumping this with the text of an email that I sent them via their contact submission form, as follows:


It's been 10 days since this incident, with nothing more said.

I quit using them months ago.  Still glad I did.  I hope this doesn't turn nasty for anyone exposed.

They responded with this:

So Verisign issued a 2 year cert, even though Dwolla only paid for one? That's odd, wonder if it was actually the other way around.

  See what Tux posted above. It was issued with a two-year validity. Apparently they revoke it if you miss a payment.

Interesting, most CAs that I have met require a payment for the full validity period, but maybe Verisign has a payment plan because they are so damn expensive for EV certs.

Also, epic fail not paying bills. ::)

A bank not paying their bills? Wow!

Good thing I am going with direct ACH payments when I can!