SSL Certificate Issues and Chrome Security Warnings¶

This guide helps diagnose and resolve SSL certificate issues, particularly Chrome's "Dangerous" or "Not Secure" warnings.

Common Issue: Chrome Shows "Dangerous" Warning¶

If Chrome shows security warnings despite having valid SSL certificates, the issue is typically with Cloudflare's SSL/TLS mode configuration.

Quick Diagnosis¶

Run the diagnostic script to identify issues:

/srv/dockerdata/_scripts/diagnose-ssl-chrome.sh

Root Cause: Cloudflare SSL Mode¶

The most common cause is Cloudflare's SSL/TLS mode being set to "Flexible" or "Full" instead of "Full (strict)".

Why This Matters¶

Flexible: Cloudflare connects to your origin over HTTP (insecure)
Full: Cloudflare connects over HTTPS but doesn't validate certificates
Full (strict): Cloudflare validates origin certificates (recommended)

Solution: Configure Cloudflare Correctly¶

Log into Cloudflare Dashboard
Navigate to SSL/TLS → Overview
Set SSL/TLS encryption mode to "Full (strict)"
Configure additional security settings:
SSL/TLS → Edge Certificates → Always Use HTTPS: ON
SSL/TLS → Edge Certificates → HTTP Strict Transport Security (HSTS): Enable
SSL/TLS → Edge Certificates → Minimum TLS Version: 1.2

Security Headers Configuration¶

Our infrastructure automatically adds security headers via Traefik middleware:

# Located in /srv/dockerdata/traefik/dynamic/middlewares.yml
security-headers:
  headers:
    stsSeconds: 31536000
    stsIncludeSubdomains: true
    stsPreload: true
    forceSTSHeader: true
    contentTypeNosniff: true
    browserXssFilter: true
    referrerPolicy: "strict-origin-when-cross-origin"
    permissionsPolicy: "camera=(), microphone=(), geolocation=()"
    customFrameOptionsValue: "SAMEORIGIN"

These headers are automatically applied to all HTTPS traffic through the websecure entrypoint.

Diagnostic Tools¶

1. SSL Certificate Diagnostics¶

# Comprehensive SSL and security check
/srv/dockerdata/_scripts/diagnose-ssl-chrome.sh

This script checks: - Certificate validity and issuer - Security headers presence - Cloudflare proxy status - SSL/TLS configuration

2. Cloudflare SSL Mode Test¶

# Quick test for SSL mode issues
/srv/dockerdata/_scripts/test-cloudflare-ssl-mode.sh

This script specifically tests: - Origin server SSL response - HTTP to HTTPS redirect behavior - Certificate chain validation

Browser Troubleshooting¶

If Cloudflare settings are correct but warnings persist:

Clear browser cache and cookies for *.rbnk.uk
Open Chrome DevTools → Security tab to see specific issues
Try incognito mode to rule out extensions
Check chrome://flags/ for experimental security settings

Certificate Information¶

Our infrastructure uses a dual-certificate setup:

Edge Certificates (Browser ↔ Cloudflare):
Issued by Cloudflare (Google Trust Services)
Wildcard certificate for *.rbnk.uk
Automatically managed by Cloudflare
Origin Certificates (Cloudflare ↔ Server):
Issued by Let's Encrypt
Managed by Traefik via ACME
DNS challenge through Cloudflare API

Verification Steps¶

After making changes:

Test SSL configuration:
```
curl -I https://yourdomain.rbnk.uk
```

Check for security headers:

curl -I https://yourdomain.rbnk.uk | grep -i "strict-transport"

Verify certificate chain:

openssl s_client -connect yourdomain.rbnk.uk:443 -servername yourdomain.rbnk.uk

Common Issues and Solutions¶

Symptom	Likely Cause	Solution
"Not Secure" in Chrome	Flexible SSL mode	Change to "Full (strict)"
Certificate errors	Expired certificates	Check Traefik logs, restart if needed
Mixed content warnings	HTTP resources on HTTPS page	Enable "Always Use HTTPS"
HSTS errors	Previous HSTS header conflicts	Clear browser HSTS cache