londonstockexchange.com untrusted charts Topic is solved

[Lunokhod]

www.londonstockexchange.com
This Connection is Untrusted
You have asked Pale Moon to connect securely to charts.londonstockexchange.com, but we can't confirm that your connection is secure.

The charts don't display in Pale Moon or in Mozilla Firefox, but it works in Chromium. I sent a message to the website yesterday but it still does it, so perhaps it's worth mentioning here too.

[Moonraker]

No problems for me.

[Moonchild]

No problem here.
Did you block any specific root or intermediary certificates?

[Moonchild]

Ah.
Their webmaster needs to make sure their cert chain offered to browsers is complete.
They are missing the GeoTrust TLS RSA CA G1 certificate to make the chain complete.

It'll work on browsers that have previously visited other sites that offered that intermediate/CA cert, but not on fresh connections that don't have the cert in their store yet.

https://www.ssllabs.com/ssltest/analyze ... change.com

[Lunokhod]

Could this also be something to do with the ca-certificates-mozilla package not having this certificate when it was expected to?
In /usr/share/ca-certificates/trust-source/mozilla.trust.p11-kit I can see for example:
Actalis S.p.A./03358520967
And if I go to:
Pale Moon - Preferences - Certificates - View Certificates
I see that certificate listed there as well.
If one is missing then it would also affect Firefox. I have quite a fresh profile on Pale Moon and have only used Firefox a few times for comparison. I have no idea myself exactly where this missing certificate is supposed to reside though.

I sent them another message anyway.

[Moonchild]

Could this also be something to do with the ca-certificates-mozilla package not having this certificate when it was expected to?

I'm not sure what this has to do with anything. Intermediate certs are not installed separately or by browser vendors in packages.
Intermediate certificates are normally provided by website owners as part of their cert chain offered from SSL, and browsers will store these intermediate certs in their cert store when first encountered.

[Lunokhod]

OK, thanks for the explanation.
I went here:
https://www.tbs-certificates.co.uk/FAQ/ ... CA_G1.html
and imported the certificate via the link, checked trust for every box in the dialogue that appeared, now the charts are shown as they should be. So that was definitely the problem there.

[Moonchild]

Of course as an end user you shouldn't have to do this, so the webmasters definitely need to be made aware of it and fix it.