https://apiblueprint.org/ access problems (edited)

al-indigo commented 8 years ago

Do not know where to report it. It seems that someone has hacked the site and replaced you certificates with self-signed. As a result:

It seems that the site is totally compromised including certs.
You can not open it entirely (with Google Chrome at least) with NET::ERR_CERT_AUTHORITY_INVALID.
If you decide to ignore the error, you will see "Service unavailable The server is temporarily unable to service your request due to maintenance downtime or capacity problems. Please try again later. "

EDIT: it seems that some russian providers are acting as man-in-the-middle for cloudfare connections; the site was not compromised

abtris commented 8 years ago

Strange, we use Cloudflare for SSL on this site and from our view looks all ok.

https://www.sslshopper.com/ssl-checker.html#hostname=https://apiblueprint.org/

al-indigo commented 8 years ago

Here's what I see (I have checked from several different computers with Mac Os X and Linux, Chrome/Vivaldi/Firefox)

Firefox also tells me that cert is valid for ip 104.28.25.8 only (there should be domain name usually, not an IP address) and it tells that the issuer certificate is unknown.

Can I check it in some other way and show you? Here is the info I see about the certificate:

apiblueprints

al-indigo commented 8 years ago

And here's what Firefox said:

`https://apiblueprint.org/

Peer's Certificate issuer is not recognized.

Форсированное защищённое соединение HTTP (HSTS): false Привязка открытого ключа HTTP (HPKP): false

Цепочка сертификата:

abtris commented 8 years ago

I will contact Cloudflare support if they can solve this problem. Thanks for report.

Almad commented 8 years ago

@al-indigo Could you please also sent IP and country you are accessing the site from? Thanks!

al-indigo commented 8 years ago

83.149.199.196, Russia (it's Institute for system programming RAS)

abtris commented 8 years ago

@al-indigo can you to http://apiblueprint.org/cdn-cgi/trace and please here output?

al-indigo commented 8 years ago

@abtris Almost the same thing (see the screenshot). Also I noticed that the problem is related to our network provider, but I don't get why could it be — the address is correct, ip seems to be correct too and it's not any kind of virus — the same behaviour is seen on lots of computers (with different OS).

apib

al-indigo commented 8 years ago

Hm, I'm almost sure that it's our provider tricks, I'll try to contact them and reply to you

abtris commented 8 years ago

That url is without HTTS only HTTP, try again.

al-indigo commented 8 years ago

fl=32f58 h=apiblueprint.org ip=85.142.16.26 ts=1465981144.643 visit_scheme=http uag=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36 Vivaldi/1.1.453.59 colo=ARN spdy=off http=http/1.1 loc=RU

abtris commented 8 years ago

Thanks, I send info to Cloudflare.

abtris commented 8 years ago

Cloudflare support thing there is problem with your server: squid - local proxy server at your end. I think there can be problem with caching.

al-indigo commented 8 years ago

I have some news.

Actually it appeared that our "censor" organ https://rkn.gov.ru/ has added this IP address to forbidden list on the territory of Russian Federation. That explains why I can go to http site: for unencrypted connections they parse HTTP headers and destination so I can go through.

Nethertheless if I go through https/ssl, they can not decrypt the traffic, so when provider detects that I go to forbidden IP, they are making MITM attack and try to pass me through their squid server. And that ruins the connection because it's actual MITM attack. Most of russian providers act like this (the second strategy is to change DNS entries for domain name and it causes the same consequences).

The reasons for the whole thing are:

You are hosted at the same IP with site joycasino (you can check it out here: https://reestr.rublacklist.net/search/?q=104.28.25.8)
Our country is suffering from internet censorship.

As I can see it, the only way to fix it is to ask Cloudfare to place your site under another IP-balancer that is not blocked. In the other case the only way to see your site from most of Russian providers is to use vpn/proxies/tor

Almad commented 8 years ago

@al-indigo Thank you very much for this. We'll pass it to Cloudflare, and we'll also think about other ways how to decouple us from their network.

I feel for you with regards to the censorship, unfortunately there isn't much we can do with that. We'll try our best to think about how to circumvent it.

kylef commented 5 years ago

I don't thinks this is still applicable, we've moved this particular domain away from CloudFlare and now it's hosted from GitHub pages:

$ curl https://apiblueprint.org/ -I
HTTP/2 200
server: GitHub.com

Providing you can access this GitHub (this issue) I would imagine that the site is now accessible for you, if you are still seeing any problems please let us know and we can reinvestigate this.

Thanks again for bringing this to our attention.

apiaryio / api-blueprint

https://apiblueprint.org/ access problems (edited) #335