Is anybody else getting a Redirect Tool error message this morning? This is a critical problem for me as I use the Redirect Tool to manage my class navigation. I've reported this as a Help ticket, but I don't know if it is just me, my school, or what the problem is. I am having the same error across all my Canvas sites; the redirect tool apps I have installed to add items to my navigation are not working.
Canvas Support says they have not gotten any other reports of this, so here are some public pages where I am having this problem on my computer; can somebody else see if you are getting an error message. Maybe it is just me, which would be great/terrible... anyway, these pages are examples:
https://canvas.ou.edu/courses/84558/external_tools/6273
https://canvas.ou.edu/courses/86141/external_tools/7460
https://canvas.ou.edu/courses/75420/external_tools/3486
https://canvas.ou.edu/courses/54178/external_tools/2484
Hopefully it is just something weird on my computer... although that seems odd too since I have never seen an error message like this before. Hmmmm. Same error message on every page with a Redirect for me, based on what I checked.
Hi Laura
Your links work for me. When I follow the first one, this is what I see:
The redirect tool also works for me in my own courses so it doesn't look like a widespread problem. Have you asked your colleagues/students if the link works for them?
Oh, I am SO RELIEVED: thank you Steve Watts!!! This is still early for my students to be up and at it. It would be great news if this were somehow just me; I can cope until we figure it out and get it fixed. Although that sure is weird... I wonder why just me!
I glossed over the fact that I could get into your course, which I remember know, that they are public.
Chrome 69, no issues
Chrome Dev (70), no issues
Chrome Production (70), no issues
In Chrome Canary (71), I am getting the warning
The webpage athttps://www.edu-apps.org/redirectmight be temporarily down or it may have moved permanently to a new web address.
For https://www.edu-apps.org/redirect
In all versions but Chrome Canary (71) I get
The URL provided is not valid
In Canary (71) I get the message you've posted in screenshots below.
Your connection is not private
...
NET::ERR_CERT_SYMANTEC_LEGACY
Nothing like rolling dice to complicate trouble shooting.
Looks like this will be rolled out to all in Chrome 71.
I tried clearing my cache, clearing all canvas, instructure, and edu-apps cookies, no luck.
But then I tried just pasting the launch URL into my browser and I got a clue: Chrome thinks there is a security problem here
https://www.edu-apps.org/redirect
Is this Chrome being overvigilant, or is there really an https certificate error of some kind...?
I'll confess to being pretty disappointed that I have not gotten a response back about this problem. It seems to be clear what is happening here from that security error message. I hope somebody at Instructure is paying attention; I decided to investigate myself since I did not hear anything more in response to my ticket and this is what I learned when I Googled this cert_symantec_legacy error:
"Error: NET::ERR_CERT_SYMANTEC_LEGACY"
If I understand this correctly, everybody who, like me, might be using Chrome70 which went live on October 16 is possibly (?) experiencing this error with the Redirect Tool and who knows what other Instructure edu-apps that are invoking a legacy Symantec certificate for security purposes.
That is just my layperson's understanding, though, and I don't understand why I have not gotten an update in response to all this from the Helpdesk. They have Google too, right? That's what I used to find this information which appears to describe exactly the problem I am experiencing.
Very frustrating not to know how long we are going to have to wait on a fix for this.
This has been announced long in advance:
Symantec Legacy PKI - The Chromium Projects
Proof of Canvas awesomeness: Brian Whitmer pinged me at Twitter about how edu-apps was one of his old projects! And so he was able to confirm that this is an easy fix; it runs in-house, so hopefully early next week somebody at Instructure can fix the certificate. If I can just get this under control in time for Can*Innovate, that works for me. I really want to be able to demo my Can*Innovate course space, and it is full of Redirect Tool nav links and I use my Chromebook for video conferencing since my desktop computer is ancient and has no webcam.
Okay, EXTREME DISSATISFACTION has now been achieved. Pinging Robert Carroll for any insight you can offer since I am by no means any kind of expert in security certificates, but here is the latest:
1. Starting on Friday morning, I became able to access any navigation links in my Canvas courses created with the Redirect Tool. I received this error message in Canvas:
The webpage at https://www.edu-apps.org/redirect might be temporarily down or it may have moved permanently to a new web address.
When I go directly to the launch URL, I get this error message:
NET::ERR_CERT_SYMANTEC_LEGACY
Screenshots of all error messages above.
2. I got no helpful information from the Helpdesk on Friday or Saturday, so on Saturday night I did my own troubleshooting and discovered that this specific Symantec legacy certificate error message is because that certificate is no longer being trusted in Chrome browsers as part of a long-announced process; the staged rollout of the certificate mistrust began on October 16. Details that I found by Googling -- all of which I shared with the Helpdesk.
https://knowledge.digicert.com/alerts/ALERT2566.html
"Error: NET::ERR_CERT_SYMANTEC_LEGACY"
and
https://sites.google.com/a/chromium.org/dev/Home/chromium-security/symantec-legacy-pki
Symantec Legacy PKI - The Chromium Projects
3. Over the weekend, I had a Twitter convo with Brian Whitmer who set up edu-apps and redirect back in the day. He agreed that it looks like a certificate that needs to be updated. I shared the details of that conversation with the Helpdesk also. I will ping Brian again at Twitter to see if he can help get through to somebody at Instructure who will listen.
4. On Monday, I heard NOTHING from the Helpdesk. I updated my case explaining that this is a serious problem that needs fixing, and if it is a certificate problem (as it surely is...???), users cannot fix the problem; only Instructure can fix the problem.
5. On Tuesday morning, the Helpdesk finally writes me back to let me know that I should adjust my privacy settings and/or disable extensions in Chrome because the problem is me.
They said they could not replicate the error, and I wrote back to explain AGAIN about the network certificate error messages and about the staged rollout, which seems to me would explain why they are not able to replicate the error. They could check on the edu-apps.org security certificate even without replicating the error... so have they checked the certificate? I don't think they have.
I am so frustrated about this. Can*Innovate is coming up on Friday, and on Monday they publicized all the presentation materials... but the course site I worked so hard to prepare in advance is going to be resulting in errors for any Chrome users who, like me, happen to be in the early stage of this staged rollout.
So, I'm sharing this information with our sysadmin and his staff so that they can pass that on to our CSM, and I'm pinging Robert Carroll and anybody else who can give me a sanity check: is there any way that a personal setting on my computer is causing this kind of error when I go to the redirect edu-apps launch page? I simply do not see how that is possible, but if somebody really thinks this is a problem on my computer, I will do some more troubleshooting. What do you think, people? I am receiving no error messages of any kind for any other website, and this error message began for me after the October date Google announced for the staged rollout of the Symantec Legacy mistrust calendar as announced back in September 2017.
https://www.edu-apps.org/redirect
See also this update from Digicert.com
https://knowledge.digicert.com/alerts/ALERT2562.html
URGENT
Chrome 70 is live as of 10-16-2018. Distrust errors may not be displayed immediately as distrust is done in stages and independent of Chrome reelease dates. Please reference the following for more information,
https://sites.google.com/a/chromium.org/dev/Home/chromium-security/symantec-legacy-pki
All SSL/TLS certificates issued from the Symantec infrastructure (before December 1, 2017) will require re-issuance to ensure continuity for your customers. This includes all brands in the Symantec family – Symantec. Thawte, GeoTrust and RapidSSL. It is strongly advised to reissue certificates as soon as possible to avoid risk or delays. Refer to our ongoing outreach for details about which certificates will be impacted, or contact your account manager now. We will replace all affected certificates at no cost to you, . Since certificates issued from the DigiCert root hierarchy are not impacted by these deadlines, you can continue to order and manage new certificates.
Putting me on the spot.
I am not very proficient in security certificates. I remember it took me a few days to get our SSL certs working for our LTI, and then I was so frustrated lazy I had them duplicate the virtual machine so I could just swap the sub domains and create our test server.
From a brief glance, because I am running a short week and today is my first day in the office.
Chrome 70 is out, I write and test most of our Canvas modifications against Chrome Canary (which is currently 71).
I attempted to install the Redirect tool (again in Canary) for the nth time with no success to try and replicate. I never see it where it says it will be, and it shows no placements after 'successfully' adding the tool.
I was aware of this certificate change for the past few months, but didn't pay attention to Canvas I assumed they'd get on top of it before it became an issue... technically they still have time...
Which browsers does Canvas support? Canvas currently supports Chrome 68 and 69.
This is some of the pain of being an early adopter or allowing Automatic Updates.
The fact that they 'cannot replicate' deserves better explanation.
Can they not replicate because it's not their certificates that are causing the problem?
Did they already fix their certs?
Did they actually test in Chrome 70?
My father recently asked me to test OSX Mojave and tell him if Adobe Photoshop would still work. I updated and found that it does not, he gets to keep using Photoshop, I'm out in the cold... and I need to design the backdrop for the nursery I have to start painting in the next couple weeks.
My current suggestion would be just to try the other supported browsers and let them triage the situation as it gets more visibility. I've had to do this with Live Events not being well documented and based on my input and desire for it there is now a flood of great information provided for the community. Sometimes you're ringing the bell, sometimes you're the first in line.
Yep, Robert Carroll, I think I am having the very bad luck of being part of the percentage included in the first rollout. I read about staged rollouts as a result of this, and apparently it is a practice that Google uses for all kinds of app updates. The stages of the rollout do not coincide with release dates for new versions of Chrome... but the Digicerts alert was very explicit about this: the idea is to replace the certificate BEFORE your users start complaining. The staged rollout is something Google does in order to prevent mass failure: the idea is for someone to pay attention to reports like mine, exactly because this is the canary-in-the-coalmine of the staged rollout. But if the Helpdesk guy is not going to get someone to check the certificate, then that is a serious problem: there is no troubleshooting I can do on my computer that will tell them about their Symantec certificate status.
For my Can*Innovate presentation on Friday, if this is still not fixed, I will have to log on with my father's Google account (I'm in Austin right now, and I log in to his Google account a lot while I am here to update his Netflix queue, etc.) ... so, yeah, that is my non-solution solution.
But I am pretty hacked off about doing my own troubleshooting and having the Helpdesk ignore the information I've provided. No wonder people don't take the time to communicate proactively. It's frustrating enough to have to do your own troubleshooting (although, admittedly, I learned a lot that might prove useful in the future ha ha), but it is beyond frustrating to have somebody from the Helpdesk ignore that information.
I'll update if/when I find out more.
But yeah, I'm glad I can just log into my dad's Google account for now. Unless he's one of the users who will get swept up in this staged rollout. Let's hope his account stays old until Friday afternoon! :-)
Based one what you've stated above, and read elsewhere, is it possible someone could download Chrome 70 and not received this 'staged' rollout? If Google does this to prevent mass failure, it could also cause issues if they are not getting that configuration in their version.
Can you access Canvas and your Google account in Firefox?
Exactly Robert Carroll ! Staged rollout does NOT coincide with Chrome version releases: it was very interesting to learn about that. So, yes, you can have live Chrome 70 and not be experiencing this error. It is rolled out as percentage of users, and I just have the bad luck apparently to be in an early group of people for whom the mistrust policy is in effect.
I'm at my dad's, so I'm stuck with my Chromebook, but I'll be home tonight (assuming Delta cooperates), so I'll be able to check on Firefox and Safari.
For my Can*Innovate presentation on Friday, though, I need to use my Chromebook; my desktop Mac is ancient, and doesn't have a webcam. Although I guess I could borrow my husband's Macbook if it comes to that. Or log into my Dad's Google account, assuming he remains unaffected.
Argh.
I appreciate your help! This is the kind of thing that I know literally nothing about, so I'm just repeating what I found at Google both at Digicerts and at Google's Chromium project documentation.
I take the bold red type at Digicerts seriously ha ha.
Hi Randy Orwin, thanks for checking! The problem has been fixed, I am pleased to report -- what made troubleshooting this difficult was that when Google does one of these staged rollouts, they affect only a percentage (large? small? who knows?) of users. Not everybody who has Chrome 70 is affected; they do it that way to prevent a mass failure. Which is great... assuming people who are in the early rollout are listened to, ha ha. I had a hard time getting the Helpdesk to listen to me, but Brian Whitmer did listen (by chance! at Twitter!), and he got someone at Instructure to end the "certpocalypse" as he called it by getting the certificate reissued last night. As soon as he saw the edu-apps error message he realized what must be happening because edu-apps was running on some kind of legacy server and the certificate maintenance got somehow lost in the shuffle.
Hi Laura Gibbs and Robert Carroll and anyone else following this thread. I wanted to let you know that I followed up with our Support folks, and then with Product and then Engineering. The short story is that Brian did get through to the right people here who are aware of the issue and are working on an architecture level solution for edu-apps that will fix this problem for Redirect and other apps as well. That work will get done as soon as we can in light of resource constraints and other demands on that team. So, sorry I can't tell you it is fixed but I wanted to share that right people are aware.
That sounds good, Scott Dennis! I felt like I was still back at square one with the Helpdesk, but if there is forward progress I will just have to wait and see. I know that edu-apps is not a Canvas product exactly, but there sure are a lot of us who use the Redirect Tool as if it were a Canvas feature because it's the only way we can configure our menu to work the way we want/need.
In a sense, I guess I'm lucky this happened while I was at my dad's: Chrome on my Mac at home is still just Chrome 69 (I just now got home and lo and behold: Chrome 69, and all is well). If I hadn't been on the Chromebook, I wouldn't have known about this error... in some ways, I guess ignorance is bliss, ha ha. But I feel really badly thinking that people will be getting errors on my Can*Innovate course.
if It's not fixed by Friday, I'll edit the homepage to put in manual links duplicating the navigation links so that people will be able to access the course content via the homepage if they have redirect errors.
But maybe it will get fixed. Fingers crossed! I don't feel stuck anymore: THANK YOU.
I do feel obliged to point out that this degrading of the legacy Symantec certificates was announced by Google over a year ago; maybe this will prompt Instructure to (re)inventory their server certificates so they can get out in front of anything else like this coming down the line in the brave new world of https everywhere.
Hi Laura, while this has been frustrating I think this will be a good idea to mention during your presentation (Can•Innovate '18 Showcase: Good Things Happen When Students Get Creative ) as the attendees will benefit from hearing about the things they should be aware of as they engage so creatively with their students.
Ha ha, yes, ALL of life as a teachable moment, @Gregory_Beyrer! :-)
Hey Laura,
I'm guessing you will be happy to know (as I was of course) that this particular security cert has been updated so Redirect should be working for everybody. I'm still on 69 myself so I wouldn't have had any inkling. As far as internal communication goes, yes, we can do better and we'll keep working on deficiencies as they come up. Thank you for helping us to get better on that front.
oh wow, let me go grab the Chromebook and see...
YES!!!!!!!!!!!!
It's working perfectly for me, lucky member of the staged rollout that I am ha ha.
THANK YOU SO MUCH!!!!!!
HAPPY DANCE :-)
haha, nice! I'm happy to hear that it worked out for you. I have to admit that my understanding of things technical doesn't extend too deeply but I'm also glad that we are changing the underlying architecture of these apps so that they are more in line with the rest of Canvas.
AGREED Scott Dennis! I use Redirect Tool in every course space I create, but until this weekend I never even knew that edu-apps was an actual Instructure project... and it's such an important part of the Canvas ecosystem.
The timing worked out great because I really wanted to send around an email to all the Canvas-involved people at my school this morning about Can*Innovate, and I was able to do that without worrying about course navigation weirdness. I just now sent around the email. Yay!
Hi Laura Gibbs and Robert Carroll and anyone else following this thread. I wanted to let you know that I followed up with our Support folks, and then with Product and then Engineering. The short story is that Brian did get through to the right people here who are aware of the issue and are working on an architecture level solution for edu-apps that will fix this problem for Redirect and other apps as well. That work will get done as soon as we can in light of resource constraints and other demands on that team. So, sorry I can't tell you it is fixed but I wanted to share that right people are aware.