Search Support

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Learn More

The certificate is not trusted because it is self signed

  • 11 replies
  • 11 have this problem
  • 70143 views
  • Last reply by Shushugo

more options

Hi, My problem can sum up to "sec_error_ca_cert_invalid into Intranet".

In fact the certificate of an intranet website present in my society is self signed. Then like write here : https://support.mozilla.org/en-US/kb/secure-connection-failed-error-message : "This is common for intranet websites that aren't available publicly." How can I ignore this warning ? because it's not published on web and I need to see the content.

Thanks to your help. ps: Sorry for possible fault I'm french.

Chosen solution

The website may try to fallback to TLS 1.0 in a way that is no longer allowed in current releases or may be using a deprecated cipher suite.

You can open the about:config page via the location/address bar and use its search bar to locate this pref:

  • security.tls.insecure_fallback_hosts

You can double-click the line to modify the pref and add full domain to this pref. If there are already websites (domains) in this list then add a comma and the new domain (no spaces). You should only see domains separated by a comma in the value column.


Read this answer in context 👍 0

All Replies (11)

more options

Hello,

Try Add Exception: FireFox -> Options -> Advanced -> Certificates -> View Certificates -> Servers -> Add Exception.

more options

iNef said

Hello, Try Add Exception: FireFox -> Options -> Advanced -> Certificates -> View Certificates -> Servers -> Add Exception.


I've already test it and the answer of it is : "No avalable information" "Impossible to obtain the state of identification of this site."

more options

Okay, that's because Firefox switched to a stricter library.

Try to modify your accepted protocols:

Type into the address bar about:config in and press Enter.

Search security.tls.version.min and security.tls.version.max

To disable SSL3 and requires TLS, double-click security.tls.version.min and enter the desired value:

   0 = SSL 3.0 
   1 = TLS 1.0
   2 = TLS 1.1 

To disable TLS , double-click security.tls.version.max:

   0 = up to SSL 3.0
   1 = up to TLS 1.0
   2 = up to TLS 1.1

If you put 0 to the both values, it worked for some people...

more options

You shouldn't change the security.tls.version.min and security.tls.version.max prefs to only enable SSL3. Leave them at their default values.

You can look at this extension:

more options

cor-el said

You shouldn't change the security.tls.version.min and security.tls.version.max prefs to only enable SSL3. Leave them at their default values. You can look at this extension:

I've test your extension but it don't resolve my problem. I'd test whis all possible configuration and my resut is simple:

  • With SSLv3, TLS 1.0 or TLS 1.1 => it's a same problem.
  • With TLS 1.2 => the connexion is impossible with error message : ssl_error_unsupported_version
more options

Try to rename the cert8.db file (cert8.db.old) and delete the cert_override.txt file in the Firefox profile folder to remove intermediate certificates and exceptions that Firefox has stored.

If that has helped to solve the problem then you can remove the renamed cert8.db.old file. Otherwise you can rename (or copy) the cert8.db.old file to cert8.db to restore the previously stored intermediate certificates. Firefox will automatically store intermediate certificates when you visit websites that send such a certificate.

If that didn't help then remove or rename secmod.db (secmod.db.old) as well.

You can use this button to go to the currently used Firefox profile folder:

more options

I've already test it and test too to delete and create new profil

more options

NEW EVENT : i've install the new update and now the message had change.

Now, it's ask me to add exception, and then it present me a new message : ssl_error_bad_mac_alert

That begins to annoy me.........

more options

Chosen Solution

The website may try to fallback to TLS 1.0 in a way that is no longer allowed in current releases or may be using a deprecated cipher suite.

You can open the about:config page via the location/address bar and use its search bar to locate this pref:

  • security.tls.insecure_fallback_hosts

You can double-click the line to modify the pref and add full domain to this pref. If there are already websites (domains) in this list then add a comma and the new domain (no spaces). You should only see domains separated by a comma in the value column.


more options

OMG ! Thanks you a lot for your help !