X
Tap here to go to the mobile version of the site.
Your Firefox is out of date and may contain a security risk! Upgrade Firefox

Support Forum

EV Green Bar not working in latest FF, works in IE and Chrome

Posted

I just purchased a new EV certificate from Entrust and installed in on my website. Now with IE and Chrome I get the nice green bar, but FF shows a blue bar and says "which is run by unknown".

Modified by ARBlue79

Additional System Details

Application

  • User Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1312.56 Safari/537.17

More Information

Tyler Downer
  • Administrator
  • Moderator
1164 solutions 6629 answers

Please update to Firefox 18.0.1 and try there

Helpful Reply

Just upgraded to the latest version and it still has the same problem. Is this a common problem with FF?

Question owner

Just go to the following site which has an EV certificate installed:

https://managed.entrust.net/idgcms/

You can check this with Chrome and IE and it displays the green bar, but not with FF.

cor-el
  • Top 10 Contributor
  • Moderator
10738 solutions 96600 answers

If you see a blue bar then Firefox uses a DV certificate and not an EV certificate.

Did you remove the old DV certificate?

Can you post a link to your site?

You can try to remove the currently used intermediate certificate to see if that makes Firefox use the new certificate.

  • Tools > Options > Advanced : Encryption: Certificates - View Certificates

Clear the cache and the cookies from sites that cause problems.

"Clear the Cache":

  • Tools > Options > Advanced > Network > Cached Web Content: "Clear Now"

"Remove Cookies" from sites causing problems:

  • Tools > Options > Privacy > Cookies: "Show Cookies"

Question owner

You can check out the public Entrust site which has an EV certificate. It does not show a green bar in FF, but does with the other browsers.

https://managed.entrust.net/idgcms/

cor-el
  • Top 10 Contributor
  • Moderator
10738 solutions 96600 answers

It is a green EV certificate for me.

Try to rename the cert8.db file in the Firefox profile folder to cert8.db.old or delete the cert8.db file to remove intermediate certificates that Firefox has stored.

If that helped to solve the problem then you can remove the renamed cert8.db.old file.
Otherwise you can rename (or copy) the cert8.db.old file to cert8.db to restore the previous intermediate certificates.
Firefox will automatically store intermediate certificates when you visit websites that send such a certificate.

If that didn't help then remove or rename secmod.db (secmod.db.old) as well.

Question owner

Thanks for the follow-up. I deleted the cert.db file entirely , cleared all my cache and history. When I go to the site, I get the attached in my browser bar. Can you post a screenshot of what you see?

cor-el
  • Top 10 Contributor
  • Moderator
10738 solutions 96600 answers

Did you inspect this certificate to see if it is really the correct certificate chain.

managed.entrust.net
Entrust Certification Authority - L1E
Entrust Root Certification Authority
Entrust.net Secure Server Certification Authority
mcapone 0 solutions 4 answers

Any updates on this? I'm seeing the same issue with Firefox 20.0.1. Not a single site is correctly displaying the green bar for EV SSL (including, for example, Paypal). I have cleared cache and removed certificates as suggested. The sites do show the green bar in Chrome and IE.

Modified by mcapone

jscher2000
  • Top 10 Contributor
2345 solutions 20793 answers

Hi mcapone, I've attached a screen shot of what I see on https://www.paypal.com/home. What do you get for that identical URL -- gray padlock? globe icon?

mcapone 0 solutions 4 answers

Gray padlock. Two other computers here are displaying the same thing, while a third computer (in one of our branch offices) appears to be correctly rendering green bars. It occurred to me that some add-on might be messing us up (the computers with the issue are all developer machines with Firebug and HTTPFox installed), but I restarted with add-ons disabled and had the same issue.

jscher2000
  • Top 10 Contributor
2345 solutions 20793 answers

Hi mcapone, if you click the gray padlock and click More Information then View Certificate, what do you see there? I've attached what I get, which is clearly indicated as an EV SSL cert. Is yours also showing as EV SSL?

Do you use any proxies that could be decrypting/re-encrypting your connection?

Modified by jscher2000

mcapone 0 solutions 4 answers

OK, no proxies or anything like that. Clicking the padlock gives all the appearance of a standard (non-EV) SSL key, but viewing the certificate clearly identifies it as an EV SSL with the same serial number and SHA fingerprint as you see.

Very interesting...

philipp
  • Top 10 Contributor
  • Moderator
2042 solutions 8887 answers

can you try to replicate this behaviour when you launch firefox in safe mode once?

Troubleshoot extensions, themes and hardware acceleration issues to solve common Firefox problems

mcapone 0 solutions 4 answers

OK, I did restart Firefox in safe mode, and the problem persisted. However, that train of thought inspired me to create a new FF profile (via -profilemanager) and launch that fresh new profile. Under the newly minted profile, the EV SSL renders properly. When I return to my original profile, I get the bad behavior again.

So, clearly, there is something questionable in one of my profile files somewhere. I've had this same profile since Firefox 3, and before that it was probably imported from Seamonkey. So I'd be the first to acknowledge that all bets are off.

However, another machine here is a relatively newly-deployed Win7 box that had Firefox only since version 19 or so, and the developer in question does not use FF much at all, so his main profile ought to be relatively clean. He, as well, has the EV display issue on his FF, but creating a new profile also corrects the display for him (under the new profile).

cor-el
  • Top 10 Contributor
  • Moderator
10738 solutions 96600 answers

Did you try to delete the prefs.js file to reset all preferences?

Where you using a userChrome.css file to customize the user interface?

strack 0 solutions 1 answers

Helpful Reply

Tools > Options > Advanced > Encryption > Validation. At least you must to check "Use the Online Certificate....". For change to be accepted restart firefox. Simply reloading page is not enough.

joshkel2987 0 solutions 1 answers

all these ideas are great for IT people who can get the green address bar to work correctly in FF but to get 10,000 of your customers to somehow no they have to do all these things with their FF brower to get a green address bar is pathetic. EV SSL when configured correctly works fine in IE and in Chrome get with the times firefox, or noboby is going to use your browser.

jscher2000
  • Top 10 Contributor
2345 solutions 20793 answers

Hi joshkel2987, do you want to give us the URL of the problem page so we can take a look and try to figure out the source of the problem?

andrew.skretvedt 0 solutions 7 answers

Strack's response about OCSP worked for me. I was having this problem too, and used GRC's fingerprinting service to verify the certificates of the sites I thought should be EV were actually presenting EV certs.

www.grc.com/fingerprints.htm

They were (including GRC), but FF was presenting only grey padlock and (unknown) for the site owner information, just as with the original question poster.

I followed Strack's suggestion and checked my OCSP option, which was off. I turned it on and restarted, at which point re-visiting EV sites returned proper EV status indication and the owner information from the certificate was properly presented as well.

I don't know why this setting should affect EV presentation in the browser. My understanding of EV in FF is that cert issuance chains root with hard-coded CA certs in the browser, so no OCSP ought to be necessary, right? Also, using OCSP involves a tradeoff between timely alerting to a compromised certificate, and leaking data about the websites you visit if you're paranoid (the OCSP request can be intercepted/logged...see Moxie Marlinspike's Convergence project for a comment on that).

Now...if I turn OCSP checking back off, will the correct EV indications stop once again?