Today my ESET Endpoint Security blocked my browser for what I know is (sorry, should be) a legitimate magazine website…
Using other browsers (Chrome, Firefox, Opera, Tor, …) on my machine, I had the same issue…
Microsoft Edge
ESET Endpoint Security is reporting
“Website certificate revoked
The certificate used by this server has been marked as untrustworthy and the connection is not safe
Try connecting again later or from a different internet connection.
Access to it has been blocked.“
Tor
Using another pc or smartphone (not using ESET) … I was able to connect.
So what’s going on?
ESET protecting you…
Eset forums
When you look up the Eset message (“Website Certificate Revoked” eset), you’ll probably land on the ESET forums or knowledge base, … seems to be a pretty popular topic.
Like for example: https://forum.eset.com/topic/21531-eset-giving-website-certificate-revoked-message/
ESET knowledge base
ESET explains
“This warning is displayed when your ESET product detects that the security certificate for a website is revoked.
ESET cannot resolve the issue because only the owner of a domain can renew their security certificate. You cannot choose to continue to the site using the insecure certificate.”
How do you double check this information?
The ESET forums point to a very interesting and eays to use tool: SSLTest at SSLLabs.com
Open: https://www.ssllabs.com/ssltest/index.html
Then you can enter the URL of the website you want to visit or check…
Depending the status of the website (good…or bad), it will take a few seconds… to minutes… to scan the website and show the quality of the certificate.
In this case, it’s fairly clear why the website was blocked:
Just for your reference if you would check a website like: https://docs.microsoft.com, you’ll get A+ (that’s the other end of the scale..)
If you want to know more about the website rating, check the SSLLabs rating guide:
https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide
The grading results in a score from A (top), (B) good, (C) average .. to (F) big fail lowest score …
So, it’s a very handy and free tool to check your website for issues.
Why are these websites not blocked by other tools or browsers?
First of all, check if you have an anti-virus or antimalware tool that checks the URL.
Because other browsers, apps or URL filters will not always check for the CRL (the certificate revocation list, containing certificates that are no longer valid…).
Or the CRL is not updated or and old CRL is cached. The ESET KB article mentioned, explains how to clear the CRL cache on your system.
Other interesting tools
The website (or mail) certificate is just one of the security indicators …
If you want to check the reputation of your URL, domain, website, mail system, DNS, … there are some more interesting tools you should have at hand, like https://mxtoolbox.com/NetworkTools.aspx.
Quite a while ago I posted an article on web and mail reputation, there is some more interesting free tools you can use to check the domain reputation.
See here: (TechNet Wiki) Hotmail/Outlook.com Solving Mass Mailing Delivery Issues
Conclusion
This situation show how easy it is to land on a website using revoked or unverified certificates…
Make sure to use a decent anti-malware and anti-virus tool. It’s worth to spend a small bit of money to protect your systems.
And if you combine it with some free tools to check the health of (your) websites and systems… you can achieve a decent level of security without spending a lot of money.
