📣 Help shape Firefox by joining our Test Days event on July 21–Aug 1 to test the Firefox Semantic History Search in Firefox Beta 142

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Learn More

bad signature

Hello I have a simple question.

I tried logging into an account yesterday, after typing name and password it showed an error page saying bad signature on certificate. I do not have a screenshot. Error occurred only one time, I think it's a problem on the other end.

My question, do I need to change the password for that account or is everything ok?

Hello I have a simple question. I tried logging into an account yesterday, after typing name and password it showed an error page saying bad signature on certificate. I do not have a screenshot. Error occurred only one time, I think it's a problem on the other end. My question, do I need to change the password for that account or is everything ok?

Chosen solution

Only one thing The unsecured sites (http) will be not affected But when you will encounter a website that does not support TLS 1.2 but support TLS 1.0 the browser will shown this error (see screenshot)

If you want to visit this less secure site click on the blue button and restore default settings (see screenshot)

Hope this help avoid future problems for you Have a nice day Thank you for your trust

Read this answer in context 👍 0

All Replies (17)

No, I thing it was the problem with the site security certificate and the owner solved it. For your peace of mind can try: Clear the cache and the cookies from sites that cause problems. "Clear the Cache": https://support.mozilla.org/en-US/kb/how-clear-firefox-cache "Remove Cookies" from site causing problem: https://support.mozilla.org/en-US/kb/delete-cookies-remove-info-websites-stored Hope this help!

Thank you for the quick response. Yes, this only occurred on one website, no others. Firefox reads the signature on the certificate before sending the password, so it would send no information that could be read by someone else, is that correct?

Sorry to bump this, but can someone please let me know the answer to the question in my last post? Firefox reads the signature on the certificate before sending the password, so it would send no information that could be read by someone else, is that correct?

Did you get an error page that says "Your connection is not secure" or "Secure Connection Failed"? In that case, Firefox does not get past the initial attempted connection for that page.

But why would you get that when you submit the login but not when you open the page with the login form? Does the site show the login form on an HTTP page and then switch to HTTP when you submit the form?

I think you probably should update the password just in case, and look for the green lock on the page with the login form in the future and if you don't see it, do a test login (fake username and password) as a test, which often switches to a secure "try again" page.

Thank you for your quick response.

I received SEC_ERROR_BAD_SIGNATURE when I attempted the login, with a try again button.

No, the site uses https for everything, green lock and all. FWIW, I did receive the same error later in Monday, but it was not after a login but after clicking to check unread messages while I was logged in.

Hmm, maybe there's an issue with your connection. Could you check here:

  • Windows: "3-bar" menu button (or Tools menu) > Options
  • Mac: "3-bar" menu button (or Firefox menu) > Preferences
  • Linux: "3-bar" menu button (or Edit menu) > Preferences
  • Any system: type or paste about:preferences into the address bar and press Enter/Return to load it

In the search box at the top of the page, type proxy and Firefox should filter to the "Settings" button, which you can click.

The default of "Use system proxy settings" piggybacks on your Windows/IE "LAN" setting. "Auto-detect" can lead to a flaky connection. You may want to try "No proxy".

Not sure whether that will help, or whether the site's servers have some problems.

I tried going to that address but I'm getting an error telling me the address isn't valid.

This error doesn't occur on any sites except one, and only happened Monday evening. I tried messaging their support, but it takes them 24 hours to reply with what looks like a canned response.

Please let me know if you need any more info.

Sorry, those steps are for "desktop" versions of Firefox, not for Android. Which Firefox has this problem?

It was 62.0.2, I updated to the latest one though.

I have logged into that site, has to be a hundred or more times and that was the first time I saw that error ever. I've been on it today and everything is running smoothly. I was just worried my password may have leaked.

The certificate is not related to your password is related to the site owner ability to encrypt the information and assure you (and the browser too :)) that this information can't be viewed be unauthorized person. The certificate is per domain not per page. This error "sec_error_bad_signature" can be related to a self-signed certificate or to an intermediate certificate error. Intermediate certificates sit between an end entity certificate and a root certificates and create an additional layer of security that assure that the root certificate keys are inaccessible. Hope this help even if is a basic explanation. Have a good day.

Modified by AnnaSycamore

I'm sorry but the certificate explanation really went over my head.

If it's any help, the site is mail.com which, when I click on the green lock, uses digicert.

OK and this is a summary of ssl server test A+ rate is very well But if you see the protocols you notice that they accept TLS 1.0 that is considered weak

Modified by AnnaSycamore

Thank you for the explanation. Are there any settings in firefox I can adjust to make my connections more secure?

canuhelp5 said

Thank you for the explanation. Are there any settings in firefox I can adjust to make my connections more secure?

Firefox already refused to make an insecure connection. I don't think any settings changes are needed.

You can try 1. In the address bar, type “about:config” and hit enter.

2. In the “Search” field, enter TLS. Find and double-click the entry for "security.tls.version.min"

3. Set the integer value to “2” to force a minimum protocol of TLS 1.1 (entering "3" would force TLS 1.2). Clear your cache and you are done!

Set it to 3 to be sure, and changed the password. Thank you to both of you for taking the time to help me with this issue.

I just want to confirm, firefox read the bad signature and did not send any information when I got the SEC_ERROR_BAD_SIGNATURE page, correct? If this is the case, you can mark this as solved. Thank you again

Chosen Solution

Only one thing The unsecured sites (http) will be not affected But when you will encounter a website that does not support TLS 1.2 but support TLS 1.0 the browser will shown this error (see screenshot)

If you want to visit this less secure site click on the blue button and restore default settings (see screenshot)

Hope this help avoid future problems for you Have a nice day Thank you for your trust