1&1 SSL Certificate Error Today

[Mark H]

Our main shop is effectively down today due to an error on some (all?) 1&1 shops using SSL on checkout - the wrong certificates are being applied to checkout which throws up a certificate error moving from shopping cart to checkout - most customers will not go past one if these. I suggest anyone with a shop likely to be affected place a test order to see if they are OK.

[Mike Hughes]

Interesting. Was this 1&1s shared SSL as I don't see what role 1&1 play with dedicated SLL?

I do wonder when this started though as I did notice that sales were slow on Monday despite traffic being high. I checked the website/cart was working OK but didn't think to look at the checkout.

Everything seems to be OK on my site now.

Mike

[Mark H]

Hi Mike

This is a Geotrust Certificate (I don't think they are branded Geotrust any more) arranged through 1&1 as part of their Professional package and is dedicated I think. We're not sure when the problem started, but it has been fixed as of about 8pm last night. 1&1 said that it was a known problem at their end, hence my message.

[Mike Hughes]

I just talked with 1&1 support to try and get some more details on this. They don't seem to have much info but from what they said it appears that the problem threw up a 'name mismatch' error and applied to all domains using the geotrust SSL certificates on 1&1.

Mark, did you notice what time the problem started? I had a few orders come in during the day and then a big bunch arrived from about 6.00pm onwards.

Mike

[Mark H]

That's right - going in through Firefox showed us the name of the certificate being applied to our checkout, which was a totally unknown, unrelated URL (happened to be a shop in Germany which presumably had a Geotrust certificate with 1&1), hence the error message. Our last order before the problem was at 12.40pm, ie early afternoon.

[pinbrook]

A little known fact is that if you upload a shop with actinic with the tick box for SSL on, and in fact there is no SSL cert installed for the domain you will get a mismatch error as described here. Usually the domain in the mismatch error does not exsist and is merely a default.

Maybe this is what happened, all SSL certs were unfindable, thus the error message - i would be less disturbed by this that having someone else's live cert applied to a store

[Mark H]

It would appear from the Firefox error message that it was a case of the wrong certificate being applied, as we have full details of that certificate, which bear no relation to our own site. Having said that, this is the only problem we have ever had with 1&1, we got straight through to a person who identifed the problem, and the problem was fixed within a few hours, so I think they did well.

(PS - I'm not just defending them because I know that you provide actinic hosting! )

[pinbrook]

(PS - I'm not just defending them because I know that you provide actinic hosting! )

this is entirely irrelevant to my reply which was simply highlighting another reason why the domain mismatch could occur - which in turn is slightly less of a security breach than having someone elses live cert applied to your site.

You seem to have missed my point - the domain mismatch could have been because there was no underlying SSL cert installed at your site rather than someone elses. In a peverse way I feel this is better than having someone elses.

In order to get an SSL cert you should undergo some basic security checks which more often than not simply determine that you are the rightful owner of the domain.

[Mark H]

"Maybe this is what happened, all SSL certs were unfindable, thus the error messages"

"You seem to have missed my point - the domain mismatch could have been because there was no underlying SSL cert installed at your site rather than someone elses"

Would Firefox have presented visitors with the details of someone else's certificate if the above were true?

[pinbrook]

Would Firefox have presented visitors with the details of someone else's certificate if the above were true?

yes it would

[Mark H]

What a very odd "feature" indeed