Avatar for Username

Søg i Support

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Learn More

Denne tråd blev arkiveret. Stil et nyt spørgsmål, hvis du har brug for hjælp.

Few days ago (after an update) FF simply refused to accept my self-signed certificate anymore

  • 2 svar
  • 1 har dette problem
  • 214 visninger
  • Seneste svar af KpuCko

KpuCko
KpuCko
more options

Hello, Few days ago I noticed that Firefox started complaining about self-signed certificate issues, although I added my CA certificate to authorities months ago. It worked without any problem, but now I'm unable to open any of my internal sites anymore.

I tried to open a random site in Chrome, but the same issue. So you immediately will say the is in the certificate, but wait. I have few VMs running on Virtualbox, so I decided to test in there. Guess what, no issues at all. I tried in Fedora 25 (the Firefox version is below 100), then tried Windows 100. Both worked. Then I decided to update FF to the latest version, guess what - it broke again =]]

So something has changed, but I really don't have a clue what causes the issue. I attach the screenshot of detailed CA view from Firefox.

Hello, Few days ago I noticed that Firefox started complaining about self-signed certificate issues, although I added my CA certificate to authorities months ago. It worked without any problem, but now I'm unable to open any of my internal sites anymore. I tried to open a random site in Chrome, but the same issue. So you immediately will say the is in the certificate, but wait. I have few VMs running on Virtualbox, so I decided to test in there. Guess what, no issues at all. I tried in Fedora 25 (the Firefox version is below 100), then tried Windows 100. Both worked. Then I decided to update FF to the latest version, guess what - it broke again =]] So something has changed, but I really don't have a clue what causes the issue. I attach the screenshot of detailed CA view from Firefox.
Vedhæftede skærmbilleder

Valgt løsning

It must be due to removed "subject common name" fallback support from certificate validation. This fallback mode was previously enabled only for manually installed certificates. The CA Browser Forum Baseline Requirements have required the presence of the "subjectAltName" extension since 2012, and use of the subject common name was deprecated in RFC 2818.

Firefox from 101.0 onward no longer use certificate CN (Common Name) for matching domain name to certificate and have migrated to only using SAN (Subject Alternate Name) so if you self sign for internal devices you’ll need to regenerate.

Læs dette svar i sammenhæng 👍 1

Alle svar (2)

TyDraniu
TyDraniu
  • Top 25 Contributor
more options

Valgt løsning

It must be due to removed "subject common name" fallback support from certificate validation. This fallback mode was previously enabled only for manually installed certificates. The CA Browser Forum Baseline Requirements have required the presence of the "subjectAltName" extension since 2012, and use of the subject common name was deprecated in RFC 2818.

Firefox from 101.0 onward no longer use certificate CN (Common Name) for matching domain name to certificate and have migrated to only using SAN (Subject Alternate Name) so if you self sign for internal devices you’ll need to regenerate.

Ændret af TyDraniu den

KpuCko
KpuCko Spørgsmålsstiller
more options

Hm, I think I saw something like "Subject Alternate Name" when I opened an internal site in Chrome.

So, let's see do I get it right - I need to recreate the CA certificate but instead using CN, I have to use SAN, right? The rest is the same?

What this means, will I be able to use again wildcard certificates for my internal sites, or I have to issue personal certificate for every site with specified SAN?

Sorry for my newbie questions, but I'm not certificate guru ;-=)

Ændret af KpuCko den