Firefox won't allow connection when site certificate is invalid

[Patrick O'Callaghan]

I need to use Firefox to connect to a specific site which has an
unrecognized SSL certificate (the specific error is "Peer's Certificate
issuer is not recognised"). I get the usual dialogue asking if I accept
the risks, but clicking on the Add Exception button does nothing. This
is FF 37.0.1 on F21.

This specific site only works with FF and IE. It used to work with
previous versions of FF, but I last used it weeks ago so I can't be sure
which exact version introduced the breakage. I've already tried running
in safe mode, to no avail.

Has anyone else seen this?

poc

[Joshua Doll]

Is the cert also expired. I've run into where if the cert is self signed,
or from an untrusted CA and expired it won't let you accept the cert.

--josh

On Fri, Apr 10, 2015 at 8:14 AM Patrick O'Callaghan <pocallaghan(a)gmail.com&gt;
wrote:

>  I need to use Firefox to connect to a specific site which has an
>  unrecognized SSL certificate (the specific error is "Peer's Certificate
>  issuer is not recognised"). I get the usual dialogue asking if I accept
>  the risks, but clicking on the Add Exception button does nothing. This
>  is FF 37.0.1 on F21.
>
>  This specific site only works with FF and IE. It used to work with
>  previous versions of FF, but I last used it weeks ago so I can't be sure
>  which exact version introduced the breakage. I've already tried running
>  in safe mode, to no avail.
>
>  Has anyone else seen this?
>
>  poc
>
>  --
>  users mailing list
>  users(a)lists.fedoraproject.org
>  To unsubscribe or change subscription options:
>  https://admin.fedoraproject.org/mailman/listinfo/users
>  Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct
>  Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
>  Have a question? Ask away: http://ask.fedoraproject.org
>

[Suvayu Ali]

On Fri, Apr 10, 2015 at 02:08:35PM +0000, Joshua Doll wrote:
>  On Fri, Apr 10, 2015 at 8:14 AM Patrick O'Callaghan
> <pocallaghan(a)gmail.com&gt;
>  wrote:
>  
>  > I need to use Firefox to connect to a specific site which has an
>  > unrecognized SSL certificate (the specific error is "Peer's Certificate
>  > issuer is not recognised"). I get the usual dialogue asking if I accept
>  > the risks, but clicking on the Add Exception button does nothing. This
>  > is FF 37.0.1 on F21.
>  >
>  > This specific site only works with FF and IE. It used to work with
>  > previous versions of FF, but I last used it weeks ago so I can't be sure
>  > which exact version introduced the breakage. I've already tried running
>  > in safe mode, to no avail.
>  >
>  Is the cert also expired. I've run into where if the cert is self signed,
>  or from an untrusted CA and expired it won't let you accept the cert. 
Try unchecking the "Query OCSP ..." box under Advanced > Certificates.

Hope this helps,

-- 
Suvayu

Open source is the future. It sets us free.

[Patrick O'Callaghan]

On Fri, 2015-04-10 at 17:44 +0200, Suvayu Ali wrote:
>  On Fri, Apr 10, 2015 at 02:08:35PM +0000, Joshua Doll wrote:
>  > On Fri, Apr 10, 2015 at 8:14 AM Patrick O'Callaghan
> <pocallaghan(a)gmail.com&gt;
>  > wrote:
>  > 
>  > > I need to use Firefox to connect to a specific site which has an
>  > > unrecognized SSL certificate (the specific error is "Peer's
> Certificate
>  > > issuer is not recognised"). I get the usual dialogue asking if I accept
>  > > the risks, but clicking on the Add Exception button does nothing. This
>  > > is FF 37.0.1 on F21.
>  > >
>  > > This specific site only works with FF and IE. It used to work with
>  > > previous versions of FF, but I last used it weeks ago so I can't be sure
>  > > which exact version introduced the breakage. I've already tried running
>  > > in safe mode, to no avail.
>  > >
>  > Is the cert also expired. I've run into where if the cert is self signed,
>  > or from an untrusted CA and expired it won't let you accept the cert.
>  
>  Try unchecking the "Query OCSP ..." box under Advanced > Certificates.
>  
>  Hope this helps, 
Thanks, I was hopeful but it didn't work, even after restarting FF.

poc

[Patrick O'Callaghan]

On Fri, 2015-04-10 at 14:08 +0000, Joshua Doll wrote:
>  Is the cert also expired. I've run into where if the cert is
> self
>  signed,
>  or from an untrusted CA and expired it won't let you accept the cert. 
I can't get any information about the cert, which may indicate an actual
problem. However I can connect using Chrome, except that the site
scripting doesn't work correctly. Clearly the site is managed by
incompetents.

poc

[Markus Schönhaber]

Am 10.04.2015 um 18:19 CEST Patrick O'Callaghan:

>  On Fri, 2015-04-10 at 14:08 +0000, Joshua Doll wrote:
> > Is the cert also expired. I've run into where if the cert is self
> > signed,
> > or from an untrusted CA and expired it won't let you accept the cert.
>  
>  I can't get any information about the cert, which may indicate an actual
>  problem. However I can connect using Chrome, except that the site
>  scripting doesn't work correctly. Clearly the site is managed by
>  incompetents. 
That definitely seems to be the case.
If you still want to access the site in Firefox, you could go there
using Chrome, download the site's certificate and import it to FF. I
haven't tried it but maybe that way FF can be forced to accept the
certificate.
OTOH: there's no other site providing the same service which is run by
someone who know what they're doing?

-- 
Regards
  mks

[Patrick O'Callaghan]

On Sat, 2015-04-11 at 10:32 +0200, Markus Schönhaber wrote:
>  Am 10.04.2015 um 18:19 CEST Patrick O'Callaghan:
>  
>  > On Fri, 2015-04-10 at 14:08 +0000, Joshua Doll wrote:
>  >> Is the cert also expired. I've run into where if the cert is self
>  >> signed,
>  >> or from an untrusted CA and expired it won't let you accept the cert.
>  > 
>  > I can't get any information about the cert, which may indicate an actual
>  > problem. However I can connect using Chrome, except that the site
>  > scripting doesn't work correctly. Clearly the site is managed by
>  > incompetents.
>  
>  That definitely seems to be the case.
>  If you still want to access the site in Firefox, you could go there
>  using Chrome, download the site's certificate and import it to FF. I
>  haven't tried it but maybe that way FF can be forced to accept the
>  certificate. 
Worth a try I suppose.

>  OTOH: there's no other site providing the same service which is
> run by
>  someone who know what they're doing? 
Unfortunately not. This is a site used for "official" purposes and there
is no way round it. And the site administrators do not respond to email.

poc

[Tom Horsley]

On Sat, 11 Apr 2015 11:47:41 +0100
Patrick O'Callaghan wrote:

>  Unfortunately not. This is a site used for "official"
> purposes and there
>  is no way round it. And the site administrators do not respond to email. 
Create a virtual machine with an older firefox in it and use the VM
when you have to access the site?

[Patrick O'Callaghan]

On Sat, 2015-04-11 at 09:03 -0400, Tom Horsley wrote:
>  On Sat, 11 Apr 2015 11:47:41 +0100
>  Patrick O'Callaghan wrote:
>  
>  > Unfortunately not. This is a site used for "official" purposes and there
>  > is no way round it. And the site administrators do not respond to email.
>  
>  Create a virtual machine with an older firefox in it and use the VM
>  when you have to access the site? 
That's one route. I already have a Windows VM so I guess I'll try it
with IE first.

poc

[Tim]

Allegedly, on or about 11 April 2015, Patrick O'Callaghan sent:
>  And the site administrators do not respond to email. 
That's so they can say that "we haven't received any complaints"?  :-\

-- 
[tim@localhost ~]$ uname -rsvp
Linux 3.9.10-100.fc17.x86_64 #1 SMP Sun Jul 14 01:31:27 UTC 2013 x86_64

All mail to my mailbox is automatically deleted, there is no point
trying to privately email me, I will only read messages posted to the
public lists.

George Orwell's '1984' was supposed to be a warning against tyranny, not
a set of instructions for supposedly democratic governments.

ZNQR LBH YBBX

[Patrick O'Callaghan]

On Sun, 2015-04-12 at 01:51 +0930, Tim wrote:
>  Allegedly, on or about 11 April 2015, Patrick O'Callaghan sent:
>  > And the site administrators do not respond to email.
>  
>  That's so they can say that "we haven't received any complaints"?  :-\
No doubt.

poc

[Matthew Saltzman]

On Fri, 2015-04-10 at 17:17 +0100, Patrick O'Callaghan wrote:
>  On Fri, 2015-04-10 at 17:44 +0200, Suvayu Ali wrote:
>  > On Fri, Apr 10, 2015 at 02:08:35PM +0000, Joshua Doll wrote:
>  > > On Fri, Apr 10, 2015 at 8:14 AM Patrick O'Callaghan
> <pocallaghan(a)gmail.com&gt;
>  > > wrote:
>  > > 
>  > > > I need to use Firefox to connect to a specific site which has an
>  > > > unrecognized SSL certificate (the specific error is "Peer's
> Certificate
>  > > > issuer is not recognised"). I get the usual dialogue asking if I
> accept
>  > > > the risks, but clicking on the Add Exception button does nothing. This
>  > > > is FF 37.0.1 on F21.
>  > > >
>  > > > This specific site only works with FF and IE. It used to work with
>  > > > previous versions of FF, but I last used it weeks ago so I can't be
> sure
>  > > > which exact version introduced the breakage. I've already tried
> running
>  > > > in safe mode, to no avail.
>  > > >
>  > > Is the cert also expired. I've run into where if the cert is self signed,
>  > > or from an untrusted CA and expired it won't let you accept the cert.
>  > 
>  > Try unchecking the "Query OCSP ..." box under Advanced >
> Certificates.
>  > 
>  > Hope this helps,
>  
>  Thanks, I was hopeful but it didn't work, even after restarting FF.
>  
I believe you want to set
services.sync.prefs.sync.security.OCSP.disable_button.managecrl to true
in about:config.


>  
>  poc
>  
>  
>  
-- 
Matthew Saltzman
Clemson University Math Sciences
mjs AT clemson DOT edu

[Patrick O'Callaghan]

On Sat, 2015-04-11 at 20:09 +0000, Matthew Saltzman wrote:
>  > Thanks, I was hopeful but it didn't work, even after
> restarting FF.
>  
>  I believe you want to set 
>  services.sync.prefs.sync.security.OCSP.disable_button.managecrl to
>  true 
>  in about:config.  
Thanks, but there is no such boolean. I only see:

services.sync.prefs.sync.security.OCSP.enabled
services.sync.prefs.sync.security.OCSP.require

both of which are set to True.

poc

[Patrick O'Callaghan]

On Sat, 2015-04-11 at 15:52 +0100, Patrick O'Callaghan wrote:
>  On Sat, 2015-04-11 at 09:03 -0400, Tom Horsley wrote:
>  > On Sat, 11 Apr 2015 11:47:41 +0100
>  > Patrick O'Callaghan wrote:
>  > 
>  > > Unfortunately not. This is a site used for "official" purposes and
> there
>  > > is no way round it. And the site administrators do not respond to email.
>  > 
>  > Create a virtual machine with an older firefox in it and use the VM
>  > when you have to access the site?
>  
>  That's one route. I already have a Windows VM so I guess I'll try it
>  with IE first. 
IE was a bust too, but Firefox 36 worked. I just used "yum downgrade" to
get it. It allowed me to indicate the exception. Going back to 37 failed
again (i.e. the exceptions don't seem to carry over from one version to
another).

It turns out that this is a known bug (or feature) with 37. For more see
https://bugzilla.mozilla.org/show_bug.cgi?id=1126034

poc

[Matthew Saltzman]

On Sat, 2015-04-11 at 23:17 +0100, Patrick O'Callaghan wrote:
>  On Sat, 2015-04-11 at 20:09 +0000, Matthew Saltzman wrote:
>  > > Thanks, I was hopeful but it didn't work, even after restarting FF.
>  > 
>  > I believe you want to set 
>  > services.sync.prefs.sync.security.OCSP.disable_button.managecrl to
>  > true 
>  > in about:config. 
>  
>  Thanks, but there is no such boolean. I only see:
>  
>  services.sync.prefs.sync.security.OCSP.enabled
>  services.sync.prefs.sync.security.OCSP.require
>  
>  both of which are set to True.
>  
>  
Strange.  I have both those flags, also set to true, but I also have hte
one I mentioned.

There was a lot of discussion about this around when Firefox 33 was
released.  I had to change some setting to get past the issue, but I
can't find the post that solved my problem now. The one I suggested
looked like the best bet.

Sorry.

>  poc
>  
>  
>  
-- 
Matthew Saltzman
Clemson University Math Sciences
mjs AT clemson DOT edu

[Patrick O'Callaghan]

On Sun, 2015-04-12 at 20:30 +0000, Matthew Saltzman wrote:
>  On Sat, 2015-04-11 at 23:17 +0100, Patrick O'Callaghan wrote:
>  > On Sat, 2015-04-11 at 20:09 +0000, Matthew Saltzman wrote:
>  > > > Thanks, I was hopeful but it didn't work, even after restarting FF.
>  > > 
>  > > I believe you want to set 
>  > > services.sync.prefs.sync.security.OCSP.disable_button.managecrl to
>  > > true 
>  > > in about:config. 
>  > 
>  > Thanks, but there is no such boolean. I only see:
>  > 
>  > services.sync.prefs.sync.security.OCSP.enabled
>  > services.sync.prefs.sync.security.OCSP.require
>  > 
>  > both of which are set to True.
>  > 
>  
>  Strange.  I have both those flags, also set to true, but I also have hte
>  one I mentioned.
>  
>  There was a lot of discussion about this around when Firefox 33 was
>  released.  I had to change some setting to get past the issue, but I
>  can't find the post that solved my problem now. The one I suggested
>  looked like the best bet. 
As I mentioned in a separate reply, FF 33 works. This seems to be a
known bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1126034

poc

[g]

On 04/10/2015 06:51 AM, Patrick O'Callaghan wrote:
>  I need to use Firefox to connect to a specific site which has
>  an unrecognized SSL certificate (the specific error is
>  "Peer's Certificate issuer is not recognised"). I get the usual
>  dialogue asking if I accept the risks, but clicking on the
>  Add Exception button does nothing. This is FF 37.0.1 on F21.
>
>  This specific site only works with FF and IE. It used to work
>  with previous versions of FF, but I last used it weeks ago so
>  I can't be sure which exact version introduced the breakage.
>  I've already tried running in safe mode, to no avail.
>
>  Has anyone else seen this? 
as yet, i have never been unable to accept a site's unrecognized
certificate. [firefox 24.8.0]

if you post url, will give it a try.


-- 

peace out.

in a world with out fences, who needs gates.

CentOS GNU/Linux 6.6

tc,hago.

g
.

[Patrick O'Callaghan]

On Mon, 2015-04-13 at 20:18 -0500, g wrote:
>  > Has anyone else seen this?
>  
>  as yet, i have never been unable to accept a site's unrecognized
>  certificate. [firefox 24.8.0] 
As I've explained, the problem is specifically with Firefox 37. I
already know it works with earlier versions.

poc

[Pete Travis]

On Apr 14, 2015 5:12 AM, "Patrick O'Callaghan"
<pocallaghan(a)gmail.com&gt;
wrote:
>  On Mon, 2015-04-13 at 20:18 -0500, g wrote:
>  > > Has anyone else seen this?
>  >
>  > as yet, i have never been unable to accept a site's unrecognized
>  > certificate. [firefox 24.8.0]
>
>  As I've explained, the problem is specifically with Firefox 37. I
>  already know it works with earlier versions.
>
>  poc
>
>  -- 
try:
  security.disable_button.openCertManager=False

--Pete

[Patrick O'Callaghan]

On Tue, 2015-04-14 at 09:22 -0600, Pete Travis wrote:
>  On Apr 14, 2015 5:12 AM, "Patrick O'Callaghan"
> <pocallaghan(a)gmail.com&gt;
>  wrote:
>  >
>  > On Mon, 2015-04-13 at 20:18 -0500, g wrote:
>  > > > Has anyone else seen this?
>  > >
>  > > as yet, i have never been unable to accept a site's unrecognized
>  > > certificate. [firefox 24.8.0]
>  >
>  > As I've explained, the problem is specifically with Firefox 37. I
>  > already know it works with earlier versions.
>  >
>  > poc
>  >
>  > --
>  
>  try:
>    security.disable_button.openCertManager=False 
It's already set to False.

poc

[Bruno Wolff III]

> 	
> as yet, i have never been unable to accept a site's unrecognized
> certificate. [firefox 24.8.0] 
There are some certs that are pinned (tor's site is one I remember) and 
you can't override those easily. If you have removed the default CAs 
and run into this you have to go somewhere esle in the config to unpin 
the certs for the special sites. I don't remember all of the details, just 
that I needed to do it to be able to visit the tor site again.