www.googleadservices.com 使用了无效的安全证书
www.googleadservices.com uses an invalid security certificate
www.googleadservices.com 使用了无效的安全证书。 www.googleadservices.com 显示以下问题：
The certificate was signed using a signature algorithm that is disabled because it is not secure.
HTTP Strict Transport Security: false
HTTP Public Key Pinning: true
请帮忙
您的客户端似乎配置错误并生成虚假消息。或者，您的连接被拦截并且代理正在使用 weak/wounded 算法。配置错误和过时的 TLS 代理是一个已知问题。另请参阅 Jarmoc 的 BlackHat 演讲 SSL Interception Proxies and Transitive Trust。
这是我对 www.googleadservices.com 的看法。据我所知，今天的标准可以接受 RSA-2048 和 SHA-256：
$ openssl s_client -connect www.googleadservices.com:443 -servername www.googleadservices.com -tls1 | openssl x509 -text -noout
depth=3 C = US, O = Equifax, OU = Equifax Secure Certificate Authority
verify return:1
depth=2 C = US, O = GeoTrust Inc., CN = GeoTrust Global CA
verify return:1
depth=1 C = US, O = Google Inc, CN = Google Internet Authority G2
verify return:1
depth=0 C = US, ST = California, L = Mountain View, O = Google Inc, CN = www.googleadservices.com
verify return:1
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 294569083916079532 (0x416850568a151ac)
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=US, O=Google Inc, CN=Google Internet Authority G2
Validity
Not Before: Jan 25 10:41:05 2017 GMT
Not After : Apr 19 10:09:00 2017 GMT
Subject: C=US, ST=California, L=Mountain View, O=Google Inc, CN=www.googleadservices.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:a2:85:55:c4:95:3d:38:30:8f:75:cc:b2:55:59:
9f:9b:6f:e5:07:92:48:e7:c9:4e:3c:9c:4a:b6:a4:
2f:05:1e:6f:8e:61:0d:85:bb:6e:be:8a:a9:27:66:
e9:31:da:ec:2a:29:8f:b5:11:05:fb:b8:d6:53:c1:
80:f4:f7:75:68:e0:46:5e:3d:9b:64:7c:26:98:95:
91:d8:e2:c7:8e:12:6b:58:24:70:9c:04:b7:da:f3:
6e:ed:a1:a0:c1:ad:32:6a:62:e7:91:8d:84:48:c9:
16:a8:49:e1:a7:bd:18:3e:fa:85:be:84:67:b4:c1:
28:24:94:d8:76:f3:fe:ac:e4:09:55:f0:42:49:97:
2d:3e:f5:c8:41:5d:67:c6:7d:4f:7f:56:80:1f:e9:
3e:fe:90:83:89:8c:9a:db:be:6c:60:b2:64:08:d0:
d9:c0:01:1a:a5:15:28:dc:89:39:52:94:b2:12:a7:
b4:ff:6b:56:56:a9:38:bb:34:4a:cc:9e:9a:57:29:
d1:bc:21:46:84:0d:3d:08:23:6f:27:e5:c9:4d:81:
e2:e9:b4:b0:05:b4:35:bd:73:13:cc:4b:db:78:51:
bb:85:f9:6f:18:38:cd:2b:55:cf:2a:5b:7c:17:de:
c1:e5:40:4c:7f:d5:8d:09:dd:c4:86:49:a3:92:ea:
39:a1
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Extended Key Usage:
TLS Web Server Authentication, TLS Web Client Authentication
X509v3 Subject Alternative Name:
DNS:www.googleadservices.com
Authority Information Access:
CA Issuers - URI:http://pki.google.com/GIAG2.crt
OCSP - URI:http://clients1.google.com/ocsp
X509v3 Subject Key Identifier:
F4:A4:33:19:C3:E0:AB:5C:C9:53:90:26:7E:AB:4E:CB:B3:99:1C:59
X509v3 Basic Constraints: critical
CA:FALSE
X509v3 Authority Key Identifier:
keyid:4A:DD:06:16:1B:BC:F6:68:B5:76:F5:81:B6:BB:62:1A:BA:5A:81:2F
X509v3 Certificate Policies:
Policy: 1.3.6.1.4.1.11129.2.5.1
Policy: 2.23.140.1.2.2
X509v3 CRL Distribution Points:
Full Name:
URI:http://pki.google.com/GIAG2.crl
Signature Algorithm: sha256WithRSAEncryption
53:db:ed:18:e3:47:b7:6d:a7:7d:5a:e1:d0:ce:be:af:48:79:
ea:1b:d4:22:64:1e:73:2d:5f:24:b2:34:e7:d8:7d:fd:f5:22:
1d:e7:5b:32:3c:f6:d2:59:87:9c:35:8b:95:5f:74:69:c7:d0:
94:1e:ce:09:de:1c:f8:48:a4:25:5b:6b:36:d6:15:87:90:2c:
a8:84:26:65:cc:fb:33:05:ba:90:dc:a0:58:00:cc:1d:b1:6b:
ed:6c:dd:e7:83:cd:bd:6c:27:ee:0e:cc:11:00:b1:49:f9:4c:
59:6e:50:15:b0:22:9f:31:ac:10:f4:dc:14:d2:5a:be:6d:47:
f5:fd:c8:d8:bd:ff:3a:de:29:dd:a9:ac:fa:5b:63:cc:ee:50:
b6:25:5e:b5:4a:c1:fa:c2:bb:c8:f2:33:e5:92:b9:ec:18:13:
2f:0b:70:86:6b:f6:94:15:ec:53:ed:af:52:2f:3e:06:9a:8d:
b5:80:a5:bc:b5:b3:56:92:a8:1b:c6:d1:cd:49:b4:04:65:b4:
be:9a:56:1c:e9:17:84:54:24:85:c4:07:ce:4e:dd:0b:f6:8d:
53:54:66:90:7f:36:77:3e:8f:40:79:79:73:75:d1:66:bd:b2:
41:ee:5f:d2:4f:e2:fa:78:c1:3d:e4:ff:a4:ae:7a:94:81:af:
d2:6a:60:2b
www.googleadservices.com 使用了无效的安全证书。 www.googleadservices.com 显示以下问题：
The certificate was signed using a signature algorithm that is disabled because it is not secure.
HTTP Strict Transport Security: false
HTTP Public Key Pinning: true
请帮忙
您的客户端似乎配置错误并生成虚假消息。或者，您的连接被拦截并且代理正在使用 weak/wounded 算法。配置错误和过时的 TLS 代理是一个已知问题。另请参阅 Jarmoc 的 BlackHat 演讲 SSL Interception Proxies and Transitive Trust。
这是我对 www.googleadservices.com 的看法。据我所知，今天的标准可以接受 RSA-2048 和 SHA-256：
$ openssl s_client -connect www.googleadservices.com:443 -servername www.googleadservices.com -tls1 | openssl x509 -text -noout
depth=3 C = US, O = Equifax, OU = Equifax Secure Certificate Authority
verify return:1
depth=2 C = US, O = GeoTrust Inc., CN = GeoTrust Global CA
verify return:1
depth=1 C = US, O = Google Inc, CN = Google Internet Authority G2
verify return:1
depth=0 C = US, ST = California, L = Mountain View, O = Google Inc, CN = www.googleadservices.com
verify return:1
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 294569083916079532 (0x416850568a151ac)
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=US, O=Google Inc, CN=Google Internet Authority G2
Validity
Not Before: Jan 25 10:41:05 2017 GMT
Not After : Apr 19 10:09:00 2017 GMT
Subject: C=US, ST=California, L=Mountain View, O=Google Inc, CN=www.googleadservices.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:a2:85:55:c4:95:3d:38:30:8f:75:cc:b2:55:59:
9f:9b:6f:e5:07:92:48:e7:c9:4e:3c:9c:4a:b6:a4:
2f:05:1e:6f:8e:61:0d:85:bb:6e:be:8a:a9:27:66:
e9:31:da:ec:2a:29:8f:b5:11:05:fb:b8:d6:53:c1:
80:f4:f7:75:68:e0:46:5e:3d:9b:64:7c:26:98:95:
91:d8:e2:c7:8e:12:6b:58:24:70:9c:04:b7:da:f3:
6e:ed:a1:a0:c1:ad:32:6a:62:e7:91:8d:84:48:c9:
16:a8:49:e1:a7:bd:18:3e:fa:85:be:84:67:b4:c1:
28:24:94:d8:76:f3:fe:ac:e4:09:55:f0:42:49:97:
2d:3e:f5:c8:41:5d:67:c6:7d:4f:7f:56:80:1f:e9:
3e:fe:90:83:89:8c:9a:db:be:6c:60:b2:64:08:d0:
d9:c0:01:1a:a5:15:28:dc:89:39:52:94:b2:12:a7:
b4:ff:6b:56:56:a9:38:bb:34:4a:cc:9e:9a:57:29:
d1:bc:21:46:84:0d:3d:08:23:6f:27:e5:c9:4d:81:
e2:e9:b4:b0:05:b4:35:bd:73:13:cc:4b:db:78:51:
bb:85:f9:6f:18:38:cd:2b:55:cf:2a:5b:7c:17:de:
c1:e5:40:4c:7f:d5:8d:09:dd:c4:86:49:a3:92:ea:
39:a1
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Extended Key Usage:
TLS Web Server Authentication, TLS Web Client Authentication
X509v3 Subject Alternative Name:
DNS:www.googleadservices.com
Authority Information Access:
CA Issuers - URI:http://pki.google.com/GIAG2.crt
OCSP - URI:http://clients1.google.com/ocsp
X509v3 Subject Key Identifier:
F4:A4:33:19:C3:E0:AB:5C:C9:53:90:26:7E:AB:4E:CB:B3:99:1C:59
X509v3 Basic Constraints: critical
CA:FALSE
X509v3 Authority Key Identifier:
keyid:4A:DD:06:16:1B:BC:F6:68:B5:76:F5:81:B6:BB:62:1A:BA:5A:81:2F
X509v3 Certificate Policies:
Policy: 1.3.6.1.4.1.11129.2.5.1
Policy: 2.23.140.1.2.2
X509v3 CRL Distribution Points:
Full Name:
URI:http://pki.google.com/GIAG2.crl
Signature Algorithm: sha256WithRSAEncryption
53:db:ed:18:e3:47:b7:6d:a7:7d:5a:e1:d0:ce:be:af:48:79:
ea:1b:d4:22:64:1e:73:2d:5f:24:b2:34:e7:d8:7d:fd:f5:22:
1d:e7:5b:32:3c:f6:d2:59:87:9c:35:8b:95:5f:74:69:c7:d0:
94:1e:ce:09:de:1c:f8:48:a4:25:5b:6b:36:d6:15:87:90:2c:
a8:84:26:65:cc:fb:33:05:ba:90:dc:a0:58:00:cc:1d:b1:6b:
ed:6c:dd:e7:83:cd:bd:6c:27:ee:0e:cc:11:00:b1:49:f9:4c:
59:6e:50:15:b0:22:9f:31:ac:10:f4:dc:14:d2:5a:be:6d:47:
f5:fd:c8:d8:bd:ff:3a:de:29:dd:a9:ac:fa:5b:63:cc:ee:50:
b6:25:5e:b5:4a:c1:fa:c2:bb:c8:f2:33:e5:92:b9:ec:18:13:
2f:0b:70:86:6b:f6:94:15:ec:53:ed:af:52:2f:3e:06:9a:8d:
b5:80:a5:bc:b5:b3:56:92:a8:1b:c6:d1:cd:49:b4:04:65:b4:
be:9a:56:1c:e9:17:84:54:24:85:c4:07:ce:4e:dd:0b:f6:8d:
53:54:66:90:7f:36:77:3e:8f:40:79:79:73:75:d1:66:bd:b2:
41:ee:5f:d2:4f:e2:fa:78:c1:3d:e4:ff:a4:ae:7a:94:81:af:
d2:6a:60:2b