When will HMRC...

[Jog On]

Sort out their website certificate

Bunch of amateurs!

Your connection is not private
Attackers might be trying to steal your information from www.gov.uk (for example, passwords, messages, or credit cards). Learn more
NET::ERR_CERT_AUTHORITY_INVALID
Subject: www.gov.uk

Issuer: GlobalSign Organization Validation CA - SHA256 - G2

Expires on: Oct 15, 2018

Current date: Jan 18, 2018

[Lance]

what's wrong with a cert with 9 months left to go?

the question is why does your browser think the authority is invalid. Looks OK to me.

[vwdan]

Fine here. Cert valid, not revoked.

Do you need to update your root CA's? Did you check it via any other means? SSL Labs is giving them an A+ rating which is normally an excellent start.

(Amateurs indeed!)

[Lance]

Fine here. Cert valid, not revoked.

Do you need to update your root CA's? Did you check it via any other means? SSL Labs is giving them an A+ rating which is normally an excellent start.

(Amateurs indeed!)

I don't think updating the root CAs will help. GlobalSign have been around year. Unless OP is using Windows 95 I think it's more likely that the OS or browser CA list has been modified. That would make the OS/browser untrusted rather than the website IMO.

[SeanT]

Nowt wrong with it: https://www.ssllabs.com/ssltest/anal....33.144&latest

[Jog On]

Must be a problem at clientco then

[centurian]

Must be a problem at clientco then

Are they using SSL Interception, where the proxy spoofs the client cert so they can inspect the traffic and see if you are up to naughty things.

To achieve this, they install new root certs on their estate. The proxy regenerates the website certs and signs them with the interceptor root. Maybe you don't have that root installed.

What's the root cert in the chain - not the issuer as that could have been spoofed as well.

[Lance]

Must be a problem at clientco then

So let’s get this right. You trusted your clients PC setup more than gov.uk ssl cert?
Personally I’d treat both with some caution.

Do you use internet banking with clients PC?

[Lance]

Are they using SSL Interception, where the proxy spoofs the client cert so they can inspect the traffic and see if you are up to naughty things.

To achieve this, they install new root certs on their estate. The proxy regenerates the website certs and signs them with the interceptor root. Maybe you don't have that root installed.

What's the root cert in the chain - not the issuer as that could have been spoofed as well.

Perhaps ever PC has the same error and they’re breeding bad user behaviour (ignoring cert errors).

[centurian]

So let’s get this right. You trusted your clients PC setup more than gov.uk ssl cert?
Personally I’d treat both with some caution.

Do you use internet banking with clients PC?

At ClientCo, they use SSL interception, but some sites (internet banking, NHS etc.) are on a whitelist for no interception.