South Africa’s biggest forum. Discuss, discover, and connect with thousands of members.
WTF!
196.23.168.147 googlemail.l.google.com
196.23.168.147 www.gmail.com
196.23.168.147 gmail.com
can't connect with gmail on a local account (capped telkom 3gb) Firefox
That's unfortunately the problem when forcing an HTTPS connection to a different server
If you do get this issue with the certificates, PLEASE ensure that the Certificate Hierarchy tree resolves back to a Built-in Token (Root Certificate) in Firefox. You can view the Certificate and then in the Details tab it would show the Hierarchy tree.Could you explain this in more detail. I've found the Hierarchy tree, but don't understand which cert I'm looking for or what it must look like.That's unfortunately the problem when forcing an HTTPS connection to a different server
C:\Documents and Settings\HX>nslookup www.google.com
DNS request timed out.
timeout was 2 seconds.
*** Can't find server name for address 196.7.18.82: Timed out
Server: google-public-dns-a.google.com
Address: 8.8.8.8
Non-authoritative answer:
Name: www.l.google.com
Address: 155.232.240.19
Aliases: www.google.com
C:\Documents and Settings\HX>Pinging www.google.com [196.23.168.147] with 32 bytes of data:
Reply from 196.23.168.147: bytes=32 time=72ms TTL=54
Reply from 196.23.168.147: bytes=32 time=71ms TTL=54
Reply from 196.23.168.147: bytes=32 time=71ms TTL=54
HavocXphere, the WebAfrica DNS server that you're using isn't working:
When you're viewing the certificate of mail.google.com, it should be the one at the bottom of the Certificate Hierarchy with the name 'mail.google.com'. If it doesn't have any certificates listed above it, with the top-most one being a 'Builtin Object Token' (root certificate built into Firefox), then the host is being spoofed and you SHOULD NOT continue.
Here's a very technical explanation of it:X509 certificates are signed by taking a hash (like MD5 or SHA1) of the X509 certificate in the DER encoded form, and then encrypting both the OID (describing the hash algorithm used) and the hash itself with the RSA private key. The RSA private key is only known by the owner of the certificate.* If you're wondering why I know so much about X509 certificates... Its because I'm working for a company where we're making our own X509 certificates
Certificates can either be signed by a CA (Certificate Authority, like VeriSign) or self-signed. Root certificates are always self-signed and their signatures can be verified by decrypting their signature with their own public key (which is stored in the X509 certificate). You'll know that the certificate is self-signed when its Issuer field matches its Subject field.
Certificates signed by a CA certificate can only be verified by decrypting the signature with the public key of the CA certificate used to sign it. The name/description of the CA certificate used to sign the X509 certificate is stored in the Issuer field. So the correct CA certificate can always be found in the list of certificates by matching the Issuer field with the CA certificate's Subject field.
CA/Root certificates can be faked if they used MD5 hash for the signature, since MD5 collisions are already known, but you still need like 200 PS3's to be able to crack it in a few days.
Firefox includes most of the trusted root certificates (listed as 'Builtin Object Tokens'). If a certificate's hierarchy doesn't start with a root certificate built-in in Firefox, then the certificate cannot be trusted, unless you made your own root certificate
196.23.168.147 gmail-imap.l.google.com
196.23.168.147 gmail-smtp-msa.l.google.comI see what you mean.
You're right about the DNS server I posted 100% dead. Was wondering what all the 8.8.8.8 were doing in my firewall records...