Unable to access Plusnet website

[#1]

Brilliant, that worked for me - many thanks!

Just for the record, I've been unable to get onto the Plusnet website through the Chrome browser on my Chromebook, while my Better Half has had no issues using the Chrome browser on her Windows laptop. As suggested elsewhere, using an alternative browser (DuckDuckGo) on the Chromebook worked without any problem, and bizarrely I can get onto here (i.e. the Plusnet Community site) using the Chrome browser without changing the TLS flag, it just seems to be the main Plusnet website that has the issue / needs the flag changing. ¯\_(ツ)_/¯

[#2]

Just adding that we are also experiencing this issue and I would agree with the assessment that the SHA1 Anchored Cert will be to blame but, when I have had a similar issue in the past (circa 7 years ago from memory) with my own WAMP stack it was indeed a server side error with sending which SSL Protocol & Cipher Suite were available for use.

[#3]

Something else related to the website structure.

https://community.plus.net/ comes up with a mixed content warning in Firefox.

https://community.plus.net/t5/Forum/ct-p/Forum does not.

[#4]

I have the same issue using Google on Android. I've had no issues with any other website apart from Plusnet. What is going on?

[#5]

@Anna3  google have started to rollout changes to the default configuration of the Chrome browser which can affect access to secure sites, This post https://community.plus.net/t5/Everything-else/Unable-to-access-Plusnet-website/m-p/1936886#M32252

explains the problem and the temporary workaround is here https://community.plus.net/t5/Everything-else/Unable-to-access-Plusnet-website/m-p/1936858#M32243

[#6]

Thank you that worked. I hope this isn't something I have to do every time Chrome has an update. 

[#7]

Is there any progress towards rectifying this server side?

[#8]

I am having the same issue on both Chrome on windows 10 and Chrome on Android. 

Only happens on plus.net, no other websites. Pretty lame for an ISP to be relying on a SHA1 based certificate in 2023, they were largely phased out about 10 years ago

[#9]

@seabasskarp - it isn't relying on SHA1 for TLS negotiation. The working theory is that it's an intermediate in the signing chain.

@jwsg - I'll try and seek an update.

[#10]

Probably because they're including the wrong root certificate along with the intermediate in the certificate download, which is not necessary as it should be in the client's root certificate store.

Using Edge, there is no issue. The root certificate used in this instance is the godaddy G2 certificate with thumbprint 45 14 0B 32 47 EB 9C C8 C5 B4 F0 D7 B5 30 91 F7 32 92 08 9E 6E 5A 63 E2 74 9D D3 AC A9 19 8E DA

SSL labs shows that the Godaddy root certificate with thumbprint C3 84 6B F2 4B 9E 93 CA 64 27 4C 0E C6 7C 1E CC 5E 02 4F FC AC D2 D7 40 19 35 0E 81 FE 54 6A E4 is sent from the server (Certificates provided 4 (5446 bytes))

https://certs.godaddy.com/repository

[#11]

This is probably of relevance.

Born from our continued renewal of a fairly long standing cert and some questionable renewal policies? 

Will shout when I have an update from the relevant team.

[#12]

The problem can be seen using SSL labs, by expanding the 'Certification Paths' section. Here you will see different results depending on the OS/platform. There will be different behaviour depending on how the client browser handles root certificates that are sent down by the server. 

[#13]

Is it not worth sending a message to customers to tell them chrome will not work to access site - it's the default browser and pretty any android phone so this issue will cause much confusion to many people if it isn't already - everything is pushed at the use the website option whenever you get in touch with plusnet ot they contact you in email etc.

[#14]

@OldBigKid - it's difficult at this stage to reliably determine how many customers are affected. It certainly isn't the majority (for now!) as the website session data for visitors using Chrome shows little reduction from what we'd normally expect.

[#15]

Fair enough. As long as you are monitoring I guess. It's going to be everyone using Chrome soon (at least in mobile I suspect) as the slow global rollout of whatever update they made to the default SSL handshake settings without changes your end at this stage it appears. If you need me to try anything to give help to work out cause let me know. I don't fiddle about with chrome settings I just update as soon as I see a updated on play store to try and keep browsing as safe as my browser can. As others have said I go to plusnet as and when so it might have broken a few updates ago for all I know. However it should still be possible to debug what's going on - harder to fault find on mobile sadly without openssl and other tools to check certs, handshaking etc but the offer is there.