Αναζήτηση στην υποστήριξη

Προσοχή στις απάτες! Δεν θα σας ζητήσουμε ποτέ να καλέσετε ή να στείλετε μήνυμα σε κάποιον αριθμό τηλεφώνου ή να μοιραστείτε προσωπικά δεδομένα. Αναφέρετε τυχόν ύποπτη δραστηριότητα μέσω της επιλογής «Αναφορά κατάχρησης».

Learn More

Firefox 101.1 Says "SSL_ERROR_BAD_CERT_DOMAIN"

  • 5 απαντήσεις
  • 5 έχουν αυτό το πρόβλημα
  • 3676 προβολές
  • Τελευταία απάντηση από rpmurph83

more options

Getting error SSL_ERROR_BAD_CERT_DOMAIN on all my sites that are signed with a SSL Cert from my internal CA since updating past version 99

This appears to be a bug starting after Firefox version 99 on Windows because after i upgraded to Firefox version 100 i started getting this on all my SSL Certs from my CA and they worked fine prior to the update. Can anyone confirm if something changed after version 100 that is causing this?

Thank you.

Getting error SSL_ERROR_BAD_CERT_DOMAIN on all my sites that are signed with a SSL Cert from my internal CA since updating past version 99 This appears to be a bug starting after Firefox version 99 on Windows because after i upgraded to Firefox version 100 i started getting this on all my SSL Certs from my CA and they worked fine prior to the update. Can anyone confirm if something changed after version 100 that is causing this? Thank you.

Επιλεγμένη λύση

It must be due to removed "subject common name" fallback support from certificate validation. This fallback mode was previously enabled only for manually installed certificates. The CA Browser Forum Baseline Requirements have required the presence of the "subjectAltName" extension since 2012, and use of the subject common name was deprecated in RFC 2818.

Firefox from 101.0 onward no longer use certificate CN (Common Name) for matching domain name to certificate and have migrated to only using SAN (Subject Alternate Name) so if you self sign for internal devices you’ll need to regenerate.

Ανάγνωση απάντησης σε πλαίσιο 👍 3

Όλες οι απαντήσεις (5)

more options

Επιλεγμένη λύση

It must be due to removed "subject common name" fallback support from certificate validation. This fallback mode was previously enabled only for manually installed certificates. The CA Browser Forum Baseline Requirements have required the presence of the "subjectAltName" extension since 2012, and use of the subject common name was deprecated in RFC 2818.

Firefox from 101.0 onward no longer use certificate CN (Common Name) for matching domain name to certificate and have migrated to only using SAN (Subject Alternate Name) so if you self sign for internal devices you’ll need to regenerate.

Χρήσιμο;

more options

So I added the SAN to the newly generated cert because as you mentioned since the SAN is now required. However, now it comes back with Error code: "SEC_ERROR_UNKNOWN_ISSUER." What's weird is both Edge and Chrome were complaining about the cert prior to adding the SAN. Once it was added, Edge and Chrome stopped complaining, but Firefox is still throwing errors.

Χρήσιμο;

more options

I think the second issue was due to a corrupted Firefox profile. I completely removed Firefox, rebooted, reinstalled 101.1, and then synced my accounts and all appears to be good now since adding the SAN. Thanks again for the reminder about the SAN requirement.

Χρήσιμο;

more options

Note that it might have been sufficient to rename/remove cert9.db in the Firefox profile folder to cleanup the certificate storage.

Χρήσιμο;

more options

Thanks for the tip, that makes sense seeing the issue after generating the new cert with SAN. Definitely going in my OneNote!

Χρήσιμο;

Υποβολή ερώτησης

Πρέπει να συνδεθείτε στο λογαριασμό σας για να απαντήσετε στις δημοσιεύσεις. Παρακαλούμε ξεκινήστε μια νέα ερώτηση, αν δεν έχετε ήδη λογαριασμό.