Certificate issue, security
 

I'd probably come here a lot more if my browser (Chrome on Android) wasn't persistently warning me about the lack of a security certificate and suggesting it's unsafe to visit hu dot com

See attached screenshot

That's weird - we did get a new certificate - it happens regularly - but you should not see that.

Do you ALWAYS get that? If so, clear your cache, something's wrong. IF it happens, try another browser. AND please report it to me ASAP so I can investigate. As I said, it SHOULD NOT happen. We are as secure as it's possible to be, we take privacy and security very seriously.

Just cleared my browser cache. Same situation persists. I don't use any other browser than Chrome on my Android cell phone because apart from here, this situation doesn't occur.

Well that's bizarre! I've tested on 6 different browsers, on two operating systems - correction 3 - and no issue.
Anyone else seeing this, especially consistently?

And just a crazy thought, have you bookmarked httpS:// or just http:// ?

It SHOULD automagically redirect with no issue, but just in case something weird on chrome on android...

I don't bookmark any website. Regarding HU, I either just surf in or clicked on a link when receiving an email telling me there's a reply to a thread I've posted on previously. The situation has been like this for the past few days.

That helps! Just a few days, or a week or more?

On and off over the last weeks, months, years. A long while ago I did inform you privately and I felt I was fobbed off with the usual try a different browser story (I recall it was on a Windows 7 machine, probably running Chrome).

I used to come to the hubb very regularly. Now, as there's so little traffic, I can catch up on what may catch my eye once a week/ whenever. The annoying security alert doesn't inspire me with much confidence, as well as having d1ck about "outwitting" it.

I don't bother mentioning it as I have to prioritise my daily tasks. I've never had that security message on any device, on any other website I've visited, ever.

You were never fobbed off - I suggested that as a try, and if I never heard back, I would have assumed it worked. We DID have some issues a long, long time ago - it was solved.

To clarify from there - the "Security alert" is bogus - there is NO ISSUE with the certificate at this time, at least that I can find. All looks perfect, and the only other recent report was sorted. See: https://www.horizonsunlimited.com/hu...t-valid-102257
The Certificate is replaced every month automatically, as per protocol.

As noted, ALL my tests show no problem, on two computers, Win7 and Win 10, and multiple browsers on each, and iOS.

IF someone else has an issue please tell me! At this point I don't know what to do as it is not reproducible by anyone but you.

Here's what I found in my research:

Check the date and time - and time zone - is correct. Probably the number one issue. Your phone SHOULD do this automatically but it COULD be set to manual time setting.

Also does it happen only on Wi-Fi somewhere, or on cell connection only?

Is your phone OLD? See next item for more on this:

We use Let's Encrypt's Certificate, so this is related:

https://letsencrypt.org/docs/dst-roo...eptember-2021/

Also see https://www.entrepreneur.com/article/388125

And for more:

https://duckduckgo.com/?t=ffab&q=chr...tb=v1-1&ia=web

Let me know what happens PLEASE!
If you still have issues I will keep looking.

FWIW, I had the same thing happen one (1) time recently. I’m afraid I paid no attention to the circumstances, in part because I’m traveling and therefore constantly shifting between phone, tablet and laptop on all sorts of interesting networks and connections. For that reason, a dire warning about the Horizons site not having the appropriate certificate merely seemed par for the course. I did find it interesting the way my little iPad tried so very valiantly to talk me out of connecting (“Are you sure you want to connect? Really, really sure? Because if you do connect, your whole world might come crashing down…” and more like that.), but I honestly don’t even remember what I did about it. It hasn’t happened again.

I can confirm the problem I encountered above was transient and hasn't happened since. My various machines are Mac OS 10 and OS 11 running Chrome.

I tried www.horizonsunlimited.com on my Windows 10 PC with Microsoft Edge, Chrome, Brave and Firefox and also on my Android phone with Chrome and had no problems at all.


Could it be that a firewall, filter or whatever is blokking the certificate info ?

Still intermittent problem (including right now as I write this at 20.19 in Germany. On Wi-Fi and 4g. Relatively new Samsung phone. Time supplied by network provider. Like I said before this problem only occurs for me on HU, never on any other website/forum. Sorry no time to read the links you posted.

Just happened to me again, too: my older Powerbook running OS 10.11.6, using Safari on a hostel wifi network. The address bar says “https://horizons unlimited.com” and the alert reads “[graphic of padlock with a diagonal slash through it] This connection is not private. This website may be impersonating “www.horizonsunlimited.com” to steal your personal or financial information. You should go back to the previous page.” This is followed by a pair of buttons: “show details” and “go back.”

well "darn" or words to that effect.
hmmm....

Ever diligent, I managed to find other sites which gave me the same message—all were weather-related (because it’s snowing and I want to know whether to push ahead or hunker down), but not all weather-related sites did this.

I don’t think it’s ever happened on my slightly newer (but still old) iPad—just the PowerBook. Doesn’t happen on my iPhone. I did automate the time/date/time zone settings on the PowerBook per your suggestion above, but no change even after re-starting. So *maybe* it’s an old OS problem, not an iOS issue.

Here's what the experts - our webhost - had to say - edited for clarity/context:

I said:

Users - a very few - continue to have intermittent certificate issues / warnings.

today:
1: "...older Powerbook running OS 10.11.6, using Safari on a hostel wifi network. The address bar says “https://horizons unlimited.com” and the alert reads “[graphic of padlock with a diagonal slash through it] This connection is not private. This website may be impersonating “www.horizonsunlimited.com” to steal your personal or financial information. You should go back to the previous page.” This is followed by a pair of buttons: “show details” and “go back.”"

Grant said: He also had the same issue "recently", so second time. He's on our site pretty much daily, and is a moderator.

their reply:

These platforms would have worked up to September 2021 but will no longer validate Let’s Encrypt certificates.
macOS < 10.12.1
...older Powerbook running OS 10.11.6


2: I (Grant) quoted user:

2: ...Still intermittent problem (including right now as I write this at 20.19 in Germany. On Wi-Fi and 4g. Relatively new Samsung phone. Time supplied by network provider. Like I said before this problem only occurs for me on HU, never on any other website/forum."

I (Grant) had an issue a number of days ago myself, on Win 10, but a refresh and restart fixed it. I'm aware of the thread: https://letsencrypt.org/docs/dst-roo...eptember-2021/


Their reply:

...new android phones/devices should not have an issue. However, older ones will and you may want to clarify with the user how old the device is. For reference from Lets Encrypt's compatibility page:
Known Incompatible
Android < v2.3.6
-------------------------------------------------

I then asked them:

"Thanks, that helps - but is there a workaround for those with older devices? Not everyone is going to upgrade for us..."


NOTE: There isn't ACTUALLY AN ISSUE WITH THE HUBB! It's only a certificate incompatibility. You CAN tell your browser to add an exception and off you go. You should NOT do this permanently for any site you don't trust. Hopefully you trust us, but we don't blame you if you don't to this level. :) For now, it's ok. We will have to see where we go with Let's Encrypt and how this gets solved.
Also NOTE: IF you have this issue with the HUBB, you WILL have it on other Let's Encrypt certificate sites. It's NOT just us. thankfully...

Hopefully that will help clarify the issue. :)

After further discussion with them, it looks like the only solution is a different certificate. And that’s a whole world of pain, aggro and cost I’m not looking forward to. And it won’t be instant.
I’m on it, :censored:

Thanks for looking into this, Grant. I’ve got no particular tech skills, and I’m definitely prone to hanging onto old devices even long after my neighbors have given them up, but I have to wonder about the rest of the world, perhaps not so thoroughly driven by the need to update constantly. I’m not special or unique.

The laptop I’m carrying (OS 10.11.6) is actually by far the *newest* of my laptops, and I’m carrying it only because I’m traveling by car, not bike or public transport. It cost about $2800 CAD only eight or ten years ago. I’m not ready to toss it aside like my neighbors would, and I can’t believe that folks in less prosperous areas of the world would be any more ready than I am.

At home I mainly use a desktop and a tablet, both 6 or 7 years old, and from the sound of it I should expect to start running into problems with these, too, within a couple of years. It seems appropriate to wonder how many others out there in the world have encountered these security alerts and just not bothered to pursue any further.

My phone is newer, but not so new that it wasn’t abandoned by Apple right after I bought it (at an appropriately huge discount). In any case, there is no way I’m using a phone for web access, except when I’ve got no other option—I’ve got enough postural issues without hunching over a tiny screen for hours at a time.

Here’s hoping there’s a cheap, easy, functional solution. Please let me know of any way I can help (in my generally clueless state).

Mark, I hear you - my laptop is 10 years old! And still fine! My phone is 5? years old iPhone 6s+ - so about 7 generations behind, but I have no issues with it on HU.
Thanks for the offer of help, but this is so highly technical I have to get someone else to do it, it's beyond my skills. And hurts my brain...

Mark, Chris, anyone else with the issue, please go to https://new.horizonsunlimited.com and see what happens. Probably best to start a new browsing session to be sure of separation.
"new" also uses Let's Encrypt, but through a different host. Wondering if that will make a difference.
thanks!

It was a noble effort, but no—same thing happens.

Same problem for me too

I tried again last night to ignore the danger message and click through. After a couple of increasingly threatening windows, my computer refused to go further—that is, it’s wouldn’t let me access the site. I didn’t explore past this point, i.e., look for a workaround; I just switched back to my tablet, which still works.

Update: Last 3 days, the security warning no longer appears for me. On both Wi-Fi and mobile internet. No, I didn't bother clearing my browser cache in the last week or so either.

Thanks Chris! Excellent - sounds like the Let's Encrypt certificate is finally working correctly. I've been scouring everything, may have fixed it without knowing! :)
Anyone else ok, or having the issue?

Looks like I was tempting fate by saying all was back to normal... The problem is back. Incredibly odd that it's so intermittent.

and we all know how hard "intermittent" issues are to troubleshoot. Crrrap.
Ok, working on it best as.

Apologies for claiming it was an intermittent issue. Seems permanent as per screenshot when I click on address bar on the browser. The browser just can't be bothered to scream the warning at me any longer...

Remains the same as ever on my laptop.

I also hang on to some outdated hardware and software, I am running Windows XP as a virtual machine on my Mac just so I can still access Garmin Mapsource and Adobe Pagemaker and I keep a Dell 17-in laptop in case of need.

But I do understand that at sometime I am going to have to let go.

I've never thought that buying end-of-life hardware just because it's dirt cheap is worthwhile in the long term, especially the way prices come down year after year.

It sounds terrible that Mark can't run Mac OSX 12.1 (Sierra) which was released only five years ago in September 2016, but in fact OSX 12.1 is backwards compatible with systems as far back as 2007. Apple stopped making the Powerbook back in 2006, so Mark's machine is now at least 15 years old.

Time to let go, donate it to a museum somewhere? :innocent:

Can't help with Chris as all we know from Chris is that his Android device is fairly new. Knowing the version number of Android might help. Upgrading to the v11 would at least take one possibility out of the equation.

Can't just sit there saying, "Sorry no time to read the links you posted." doh

Tim
The issue isn't particularly my or Mark's machines. The issue is that on no other forum/website do I see this issue. I spend a huge amount of (too much) time on the internet.

Grant may be concerned regarding the (lack of) traffic or engagement on hu/hubb. If it's because new and old users surf in and get screamed at by a security warning, they might not stick around to read this thread or the links posted.

Why should I read links that don't affect me? I'll take it on trust that HU is safe and tolerate the workaround to outwit the security warnings. It's not my website.

Just a follow up to this discussion, i sent long term member G30ff a link he may have been interested in & his reply today on FB was this.

"Weird that, I couldn't open that link with my tablet, nor would it log on to horizons unlimited website... due to "security issues"... opened straight away with my phone"

I am having no issues myself.

Mezo.

I often point people at HUBB and today got a message saying the person couldn't access the site and in response to my questions wrote back saying,

"this site is not secure, the certificate was not valid. I just checked again, and get the same error. I have a fairly new laptop about six months old, Windows 10, it does not give me much confidence that the site may be out of date, or the certificate is not valid etc, I don't get these issues on other websites."

Someone else on that thread said they had no problems, the person responded,

"I will give the site a miss, I'm not going to keep trying to access the site that says its dangerous to access. my browser is up-to-date, therefore, I think it would be better for the site owner to fix their site, rather than ask us to take risks accessing it."

I've suggested he tries on a smartphone, if he comes back I will update.

damn that's annoying! Ok, on it - again.
thanks!

I know I know...
 

it's an old Win7 PC
but I thought you might want to know that today I get this message:

thanks Toyark, not a lot can be done about it it seems. OLD stuff will have difficulties with the new security settings, variable everywhere, so sites are fine, a few are not so fine. Since the number of OLD devices using our site seems to be VERY low, and it's hard and expensive to "fix" it, I'm going to leave it.

Might the reason for not many old devices visiting HU be that that their users are scared off by your security warning and hence never arrive?

Good to know it's all down to money and ability that the situation can't be fixed. "They all do that, sir" as a certain vehicle brand salesman might say :innocent:

An aside. An hour ago I again (not as frequent as the security warnings, but still...) got these 2 messages when I tried to visit the hu homepage as well as click on the link in my email notification of a new reply to this thread. See screenshots.

Ps. Have a brand new handset (Santa visited early) Faster, more rugged, waterproof, bigger memory, much longer battery life, rather than because I cared about hubb security warnings :nono: and said security warnings have gone away :mchappy:

Pps. Also now again using a 10 year old W7 desktop PC that I had forgotten the password for, but managed to crack (aren't YouTube tech videos great!) and no security warnings there either :D

Thanks for reply Grant. Not a problem for me; I just thought you might like to know.
I guess OLD stuff just has to be retired sooner or later and I'm guessing we're next eh? !!! ;)
Merry Xmas!:)

Excellent!