FF36 works fine, FF38 fails (at least on OSX - other OSes not yet tested, we've frozen FF updates until this is resolved). Chrome and Safari work.
We have an internal CA… (read more)
FF36 works fine, FF38 fails (at least on OSX - other OSes not yet tested, we've frozen FF updates until this is resolved). Chrome and Safari work.
We have an internal CA to generate certificates, when we started updating to FF38 found that we get SEC_ERROR_BAD_DER when trying to connect to servers using these certificates. At first thought it was perhaps because we had not yet upgraded to SHA256 certificates, but I upgraded one and tested and still get the error.
From Wireshark I can see the following:
1: TLS handshake starts, the server responds
2: client asks for a change cipher spec
3: server responds with encrypted handshake message
4: browser shows SEC_ERROR_BAD_DER
This is occurring on both Apache 2.2.x and Tomcat web servers, across multiple physical servers (CentOS 6.x).
Every web based tool I can find says there is zero problems with our certificates, and all other browsers agree.
I have tried playing with the settings in about:config based on some googling (insecure_fallback_hosts, version.fallback-limit, version.min) and none made any difference.