All Products Community Forum

Hello to all,

I wanted to use DoH (dnsforge.de) under “maximum protection”, but with one exception: I would like Ecosia.org to be able to place ads for me, because I am convinced of Ecosia and want to support this project. Tested this with Cloudflare as well, setting up an exception here does not work either.

Now the exception set in Firefox has no effect. It should not be due to the DNS provider, because Ecosia.org is not blocked and has even been whitelisted.

What is the expected behavior of the “maximum protection” setting?

Kind regards

I see this question was asked before (https://support.mozilla.org/en-US/questions/1415951) but the thread is now archived and I don't think the concern of the poster was understood/answered.

Your Thunderbird profile contains all the credentials needed to "be you" by having full access to all linked email accounts. In order to protect these accounts a Private Password can be created. It prevents someone trying to use Thunderbird as you (using your profile) from seeing the passwords or establishing connections to the email servers.

The question I have (and I believe was being asked) is, does using a Private Password actually encrypt the account credentials, or does it just block someone when they're using the Thunderbird program? Asked another way, would a bad actor with access to the profile and access to appropriate sleuthing tools be able to recover the credentials--from the files alone--thus bypassing the private password of the Thunderbird program?

I can't send mail via smtp.comcast.net. I can connect to IMAP and get mail, and I can send from my iphone and (new) Outlook. Running TB v142.0 (64 bit) on Windows 11. Issue is reproducible on second system. When I try to send mail, client tries for 1 minute, then times out with "Sending of the message failed. The message could not be sent because the connection to Outgoing server (SMTP) smtp.comcast.net timed out. Try again."

TB log says: 14:17:11.775 1756750631775 addons.xpi WARN Checking C:\Program Files\Mozilla Thunderbird\distribution\extensions for addons 14:19:37.714 mailnews.smtp: New client instance SmtpClient.sys.mjs:121:17 14:19:37.716 mailnews.smtp: Connecting to smtp://smtp.comcast.net:587 SmtpClient.sys.mjs:141:19 14:19:37.799 mailnews.smtp: Connected SmtpClient.sys.mjs:429:17 14:20:39.211 mailnews.smtp: NetworkError: a Network error occurred SmtpClient.sys.mjs:476:17

   _onError resource:///modules/SmtpClient.sys.mjs:476

14:20:39.212 mailnews.smtp: Socket closed. SmtpClient.sys.mjs:550:17 14:20:39.214 mailnews.smtp: SecurityError info: PR_END_OF_FILE_ERROR SmtpClient.sys.mjs:491:21 14:20:39.245 mailnews.send: Sending failed; The message could not be sent because the connection to Outgoing server (SMTP) smtp.comcast.net timed out. Try again., exitCode=2152398868, originalMsgURI=imap-message://mgiul%40comcast.net@imap.comcast.net/Drafts#57692 MessageSend.sys.mjs:343:32

smtp.comcast.net is using a self-signed cert. Is this the problem? C:\Users\rchar>openssl s_client -starttls smtp -connect smtp.comcast.net:587 Connecting to 96.103.145.180 CONNECTED(000001F8) depth=3 C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=AAA Certificate Services verify error:num=19:self-signed certificate in certificate chain verify return:1 depth=3 C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=AAA Certificate Services verify return:1 depth=2 C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Certification Authority verify return:1 depth=1 C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Organization Validation Secure Server CA verify return:1 depth=0 C=US, ST=Pennsylvania, O=Comcast Corporation, CN=smtp.comcast.net verify return:1 --- Certificate chain

0 s:C=US, ST=Pennsylvania, O=Comcast Corporation, CN=smtp.comcast.net
  i:C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Organization Validation Secure Server CA
  a:PKEY: RSA, 2048 (bit); sigalg: sha256WithRSAEncryption
  v:NotBefore: Jan  6 00:00:00 2025 GMT; NotAfter: Jan  6 23:59:59 2026 GMT
1 s:C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Organization Validation Secure Server CA
  i:C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Certification Authority
  a:PKEY: RSA, 2048 (bit); sigalg: sha384WithRSAEncryption
  v:NotBefore: Feb 12 00:00:00 2014 GMT; NotAfter: Feb 11 23:59:59 2029 GMT
2 s:C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Certification Authority
  i:C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=AAA Certificate Services
  a:PKEY: RSA, 4096 (bit); sigalg: sha384WithRSAEncryption
  v:NotBefore: Jan  1 00:00:00 2004 GMT; NotAfter: Dec 31 23:59:59 2028 GMT
3 s:C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=AAA Certificate Services
  i:C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=AAA Certificate Services
  a:PKEY: RSA, 2048 (bit); sigalg: sha1WithRSAEncryption
  v:NotBefore: Jan  1 00:00:00 2004 GMT; NotAfter: Dec 31 23:59:59 2028 GMT

--- Server certificate

MIIHATCCBemgAwIBAgIRAJUASDPOQisnR1zo9CfhXcYwDQYJKoZIhvcNAQELBQAw gZYxCzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAO BgNVBAcTB1NhbGZvcmQxGjAYBgNVBAoTEUNPTU9ETyBDQSBMaW1pdGVkMTwwOgYD VQQDEzNDT01PRE8gUlNBIE9yZ2FuaXphdGlvbiBWYWxpZGF0aW9uIFNlY3VyZSBT ZXJ2ZXIgQ0EwHhcNMjUwMTA2MDAwMDAwWhcNMjYwMTA2MjM1OTU5WjBdMQswCQYD VQQGEwJVUzEVMBMGA1UECBMMUGVubnN5bHZhbmlhMRwwGgYDVQQKExNDb21jYXN0 IENvcnBvcmF0aW9uMRkwFwYDVQQDExBzbXRwLmNvbWNhc3QubmV0MIIBIjANBgkq hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAoLkgKQUqw4MylCObwwzTyFkIoMN/NRNl 6EY0zS+sjlYMFPplSULdfqs1tEcWZhCs+u1EkJN9+/juCtzeZ9c73yx8nTph0/KZ 5ri9t55yu5xhtuDv2WsMJmqcTOHPXRSZt7abpsvNfxCb6IG2YdPrBNqPyZPEJ6jn h3CY3qBbsreL4iR+UEGunSJAg2mRXHhx0/aYN3CTUetOcSBzIwoFXPklptWCcm5V knK+BWqFtKlyt6nHW/o2qK74nLDgKNUgxR9pG/Bw48ZER1emGsNlN2RVyOBtoAAG 15x4vD2iFBVEe9A0q9HOJc9bGSNb6zuU4ZpCb+RpNq3kkqJCpS6aJwIDAQABo4ID gDCCA3wwHwYDVR0jBBgwFoAUmvMr2s+tT7YvuypISCoStxtCwSQwHQYDVR0OBBYE FHz0nGUjqJ0rg0OQFz/hLkJ581OVMA4GA1UdDwEB/wQEAwIFoDAMBgNVHRMBAf8E AjAAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjBKBgNVHSAEQzBBMDUG DCsGAQQBsjEBAgEDBDAlMCMGCCsGAQUFBwIBFhdodHRwczovL3NlY3RpZ28uY29t L0NQUzAIBgZngQwBAgIwWgYDVR0fBFMwUTBPoE2gS4ZJaHR0cDovL2NybC5jb21v ZG9jYS5jb20vQ09NT0RPUlNBT3JnYW5pemF0aW9uVmFsaWRhdGlvblNlY3VyZVNl cnZlckNBLmNybDCBiwYIKwYBBQUHAQEEfzB9MFUGCCsGAQUFBzAChklodHRwOi8v Y3J0LmNvbW9kb2NhLmNvbS9DT01PRE9SU0FPcmdhbml6YXRpb25WYWxpZGF0aW9u U2VjdXJlU2VydmVyQ0EuY3J0MCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5jb21v ZG9jYS5jb20wggGABgorBgEEAdZ5AgQCBIIBcASCAWwBagB2AJaXZL9VWJet90OH aDcIQnfp8DrV9qTzNm5GpD8PyqnGAAABlDwZ58gAAAQDAEcwRQIhAOgI6NbRS4t6 9XvPVbmFixPHyFJXDqU60dv5r+RB9Y9YAiAwlfQhXe45ccND3T5te2KryuxvRhzW aBO3oIS6ixw6DAB3ABmG1Mcoqm/+ugNveCpNAZGqzi1yMQ+uzl1wQS0lTMfUAAAB lDwZ56oAAAQDAEgwRgIhAKmynGx19jBgk4Xy/eChCKjR/vpOtCH16470/jJyY6Yy AiEAkwlRN7Cn1AN20CGjNowsJ2PBaqNOk/u297W/RttgBKMAdwDLOPcViXyEoURf W8Hd+8lu8ppZzUcKaQWFsMsUwxRY5wAAAZQ8GefaAAAEAwBIMEYCIQDyR2Zz3Spd 0Gul6Z2dJa15aUEiEaW7KEAtbCcqz/zoLwIhAIV8YxWeI8rVaAvdl9kWquejUOTx M2G4iYjeZINb1VMgMEMGA1UdEQQ8MDqCEHNtdHAuY29tY2FzdC5uZXSCEHNtdHAu eGZpbml0eS5jb22CFHd3dy5zbXRwLmNvbWNhc3QubmV0MA0GCSqGSIb3DQEBCwUA A4IBAQBgn3Z51e8DZ/bO/AFqc22A4e5EqfUx4y6itcaz3mnQcU9pAsA/LK/WeY+e PtHIkWNKFlysJSbU2ByJ/6+bnebalXgRZ3sAeB2Z7UIUIHEjhcEQE2s4CxAXBiI7 SgqWjrw/Qj+AOghhMwayhIjmnNk34MmyY4f9KsAC6fIEn9ypCxuaN4lrwZcmS8iK o6PRho6pd837BEaRNIZBQpI/8WKxoKsNOu8bw8FwX/Zn8q+1oPo+0sQkmSmWOruu l8tlq8boA5R6YSBWek8hxmEZppvBs55wfNCnr2DQ4CgAREJZMKt6PIiKlgQ9r58b OSb5otnW7xsrx3SKM2zlvRA5mhfL

subject=C=US, ST=Pennsylvania, O=Comcast Corporation, CN=smtp.comcast.net issuer=C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Organization Validation Secure Server CA --- No client certificate CA names sent Peer signing digest: SHA256 Peer signature type: rsa_pss_rsae_sha256 Peer Temp Key: X25519, 253 bits --- SSL handshake has read 6708 bytes and written 1662 bytes Verification error: self-signed certificate in certificate chain --- New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384 Protocol: TLSv1.3 Server public key is 2048 bit This TLS version forbids renegotiation. Compression: NONE Expansion: NONE No ALPN negotiated Early data was not sent Verify return code: 19 (self-signed certificate in certificate chain) --- 250 OK --- Post-Handshake New Session Ticket arrived: SSL-Session:

   Protocol  : TLSv1.3
   Cipher    : TLS_AES_256_GCM_SHA384
   Session-ID: 27FBCE0D025BF752A9F038657257E923F1E5560B92BB78A47C5C9E0FFFDBEF7B
   Session-ID-ctx:
   Resumption PSK: FAFF92690FBEDF157D2856329FDABB033F2A0948C5A0F668E4B69C197EC6E52B8DE8A676EA4A78EAEEED7E90C4935DEC
   PSK identity: None
   PSK identity hint: None
   SRP username: None
   TLS session ticket lifetime hint: 300 (seconds)
   TLS session ticket:
   0000 - 97 cc 16 34 49 69 e3 c2-8f 6b ab cb e0 53 cb c1   ...4Ii...k...S..
   0010 - e0 31 10 bf c8 94 c5 d1-59 2b 3e 84 f7 63 44 be   .1......Y+>..cD.
   0020 - 3e d6 69 b0 d4 10 7a 1a-4f 6a da 21 91 6b 34 f2   >.i...z.Oj.!.k4.
   0030 - 1c 2c df cc 5f ee b5 ce-4c 71 49 b0 28 d6 7b 92   .,.._...LqI.(.{.
   0040 - 9e 6a dd bb 93 ca 9e 44-80 1f df ec f7 e4 95 04   .j.....D........
   0050 - 7c c1 6b 1d 86 59 7c 18-7d 98 41 0d 04 a1 f1 ae   |.k..Y|.}.A.....
   0060 - 7b 6d 68 ad 68 a6 b2 32-95 71 d3 89 09 ea 28 7c   {mh.h..2.q....(|
   0070 - ee 8f 67 1e ab e6 09 d7-5d c6 67 0d 0e 63 7b 24   ..g.....].g..c{$
   0080 - 87 cc fb eb 8f a8 c6 67-60 d2 70 e6 58 93 06 d0   .......g`.p.X...
   0090 - 1f ef 95 15 53 92 95 19-85 76 91 26 7c a1 9e 96   ....S....v.&|...
   00a0 - 12 9d bd b2 a9 38 45 05-a5 28 14 65 4c ac c0 6d   .....8E..(.eL..m
   00b0 - c6 65 e7 b8 4b ff 0c dd-58 82 c9 c5 de 8d 64 ab   .e..K...X.....d.
   00c0 - f4 59 c5 5c bc bd c2 e9-34 2a d7 a7 99 21 97 60   .Y.\....4*...!.`

   Start Time: 1756752732
   Timeout   : 7200 (sec)
   Verify return code: 19 (self-signed certificate in certificate chain)
   Extended master secret: no
   Max Early Data: 0

--- read R BLOCK --- Post-Handshake New Session Ticket arrived: SSL-Session:

   Protocol  : TLSv1.3
   Cipher    : TLS_AES_256_GCM_SHA384
   Session-ID: 13DA31F60D1C9A3207FFEA54D2CEC29BB0D44016068E3E79A18492F695B02E80
   Session-ID-ctx:
   Resumption PSK: 44D18B4AEB19CDEBA968E3BD867C3B0167C07C61DC3091072882660FC234D4B3B071B663546C5B4AC3E53A6A5C206A9B
   PSK identity: None
   PSK identity hint: None
   SRP username: None
   TLS session ticket lifetime hint: 300 (seconds)
   TLS session ticket:
   0000 - 97 cc 16 34 49 69 e3 c2-8f 6b ab cb e0 53 cb c1   ...4Ii...k...S..
   0010 - 09 52 42 f9 c9 f7 bc 99-5a b5 73 e3 9b b8 1c 91   .RB.....Z.s.....
   0020 - 16 f5 ea 33 20 29 e1 59-79 65 46 0a 4b ad b7 fe   ...3 ).YyeF.K...
   0030 - b4 aa b7 7b f8 57 36 10-71 09 19 c6 d2 64 c4 8a   ...{.W6.q....d..
   0040 - 47 f6 28 4b 62 9e be ca-d9 16 1a e7 df 7d 51 f7   G.(Kb........}Q.
   0050 - f6 66 04 fe 37 cf 0c bb-4f d8 d3 1b d6 06 be d0   .f..7...O.......
   0060 - 21 ee 9e 65 ac a3 18 80-31 b7 17 5b 23 d2 9d 4e   !..e....1..[#..N
   0070 - 57 f7 b0 66 01 5f cc c5-a1 a5 96 ee d2 d8 55 ed   W..f._........U.
   0080 - 5b 91 86 da 91 d5 3d 17-36 bd a5 97 58 ab fb ad   [.....=.6...X...
   0090 - eb eb 38 5e fd e3 7a 13-b9 f8 5c 14 f5 80 3a 72   ..8^..z...\...:r
   00a0 - 52 66 d9 23 8c a3 50 5c-3c e5 fc cb 22 21 11 3f   Rf.#..P\<..."!.?
   00b0 - a6 71 87 67 8b 33 8e b0-0a 65 46 f6 df 7a f0 f3   .q.g.3...eF..z..
   00c0 - 04 4e cf 22 ad 4d 45 69-53 9c 45 56 df 07 ae e3   .N.".MEiS.EV....

   Start Time: 1756752732
   Timeout   : 7200 (sec)
   Verify return code: 19 (self-signed certificate in certificate chain)
   Extended master secret: no
   Max Early Data: 0

--- read R BLOCK closed

C:\Users\rchar>

Здравствуйте, мы пользуемся программой Kaspersky Security Center, у нас возникла проблема. После изменения политики, постоянно меняется самоподписные сертификаты почты (Thunderbird) и каждый раз приходится подтверждать их заново. Просьба оказать помощь в решение данной проблемы.

________________________________________________________________ Hello, we are using the Kaspersky Security Center program, and we have a problem. After changing the policy, the self-signed mail certificates (Thunderbird) are constantly changing, and we have to re-verify them every time. Please help us resolve this issue.

I receive a lot of Thunderbird messages with this text (in French) :

"Le certificat pour imap.gmail.com ne provient pas d’une source sûre."

What I have to do please Thnx

When adding a new email account, the built-in web browser launches and displays the OAuth screen. To verify the security of the destination site, I want to click the green lock icon in the URL bar to check the details, but I can’t click it.

Does a green lock icon mean a secure connection has been established?

I have 2 emails provided by my ISP (knology), I have received no emails since 7:30 on 12/5, the are on the webmail site. The other 2 emails are gmail accounts they are working fine. I am getting a message, "The certificate for imap.knology.net is not valid for that server. Someone could be impersonating the server, you should not continue."

 The fact that the gmails work and knology does not work is a clue but I don't know what it means.

I have contacted my ISP and after 45 minutes they gave up and said they will escalate and get back to me,

with in a couple days! it was on a Saturday.
                                                         Thank you, Mike

I am using a E-mail server that uses LetsEncrypt certificates. I was using Thunderbird 128 ESR without problems. When the certificate was updated, I was requested to confirm - then sending E-mails was possible. Now I have updated to Thunderbird 140 ESR. The E-Mail servers LetsEncrypt certificate was now updated but in Thunderbird I do not get any information about this, nor get I requested to check the new certificate. The SMTP connection just fails. The IMAP access to the E-mail server works fine. (IMAP and SMTP work both fine with K9-Mail on my mobile device)

How can I get Thunderbird to ask me again to check the updated certificate?

I used Chrome until two days ago. I just got tired with how shitty the browser was, how bloated it made my computer, and how much Google treats everyone like a data product. However, I use hella google systems from Voice to Chrome to Drive to more and it all worked great together. Choosing to change to Firefox wasn't an easy decision but I knew it was a good one

Which makes it super irritating that some of the functionality is already facing problems. I have shortcuts I built to make it easier to study or do random things so I don't get distracted or tired. One shortcut is clicking a key that should launch UWorld in my default browser & use Lastpass to autologin (I couldn't get it to launch the service but that was a separate issue).

I check if autologin was on for the password on LastPass I've allowed all permissions to the LastPass extension I clear my cookies on UWorld & turned off enhanced tracking protection for the UWorld login portal site

What should I do to fix my one button shortcut again?

I really don't want to go randomly turning off every protection that Firefox gives me to figure it out so I'd appreciate someone who understands the browser better helping me out. Also, bonus points if you can help me build a single shortcut button on my Mac that can launch UWorld & navigate me straight to the question bank. (I do think the issue with autologin on LastPass is going to become more of an issue as I start opening up more websites I used to use on Chrome so I'd rather nip it in the bud before I see the problem occur more often)

I'm used to check certs with right click on icon beside the address. Also for own servers in my local LAN I need this. I know there is Let's Encrypt. But sometimes it's more easy to just have a self signed cert and verify it myself. Also I want to see, who signed a cert from www.snakeoil.com/insert_your_credetials.

Please help.

rundekugel

For the past few days almost every site I try to visit gets the error:

Secure Connection Failed An error occurred during a connection to.... SSL received a record that exceeded the maximum permissible length. Error code: SSL_ERROR_RX_RECORD_TOO_LONG

this has happened on and off in the past for one or two sites but usually fixes itself within a day or less but this time it's been days. I tried everything I've seen online: -Try without add ons, - I am using 'system settings' proxy, -Followed an 8-yr-old suggestion of switching security.tls.version.max from 4 to 3 -My AV doesn't have HTTPS scanning that I can disable -It doesn't allow me to toggle the 'enhanced tracking is on' in the address bar -I've tried adding a site as an exception to DNS over HTTPS and turning Enable DNS over HTTPS off

Nothing has helped. These are all sites I've used in the past. I am using Nightly v150 at the moment but obviously same situation with FF or R3dfox.

If anyone can suggest how to bypass this so I don't have to use Edge/Chrome/Supermium (which all display these sites without issue) I'd appreciate it so much!

(*I'm looking for help with THIS issue on a W7 laptop, not about whether I should upgrade the OS.)

Thanks.

Am receiving a message reading-

The certificate for imap.gmail.com does not come from a trusted source.

Add Security Exception? I can't send any outgoing email messages. I now get a warning alert after hitting Send entitled "Add Security Exception". It says further, "You are about to override how Thunderbird identifies this site." And, "Legitimate banks, stores and other public sites will not ask you to do this." My email provider is Earthlink and the alert identifies the server location as, "smtpauth.earthlink.net:587" and says, "This site attempts to identify itself with invalid information. Unknown Identity. The certificate is not trusted because it hasn't been verified as issued by a trusted authority using a secure signature."

That only available options are, "Confirm Security Exception" and "Cancel". Selection of either option brings up the same next alert, "Send Message Error", "Sending of the message failed. Peer's Certificate issuer isn't recognized. The configuration related to smtpauth.earthlink.net must be corrected."

I didn't intentionally change any settings or receive any notification from Earthlink to that effect, so I don't know why any of these protocols would have changed. I can view the smtpauth.earthlink.net certificate but I don't know how to copy it or attach it for diagnostic purposes. Can anyone provide insight regarding what is going on here and how to resolve it? Any solutions will be greatest appreciated.

Hi - I have had gmail and my internet provider email accounts on Thunderbird working for years. Suddenly, a few days ago, I started getting certificate issues from Thunderbird warning me of the security risks. I chose to override. Now I am unable to download (imap) from either email server. I no longer receive the certificate risk dialog box. When I click on File>Get New Messages, message appear at the bottom of the page indicating Thunderbird is "connecting to the imap server" or "checking mail server capabilities", but nothing downloads. What do I need to do to correct this? Access to both servers stopped at the same time so I don't believe anything changed on the server end.

Thanks, Alan

On my Linux machine, I exported the public key for an email address in Thunderbird 140.8.0esr (64-bit) into a file. I transferred the file to my Windows 11 machine via Warpinator.

On the Windows machine I am running Thunderbird 148.0.1 (64-bit). In Account settings>End-to-End encryption, I click Add Key>Import an existing OpenPGP key>Select File to import, and then I select the file.

I get an error message: Error! Failed to import file.

I'm surprised. I would think that going from one installation of Thunderbird to another would work this way. I am concerned that I won't be able to read incoming encrypted emails without the key working.

Can someone help me?

Certificate errors have been an ongoing, several-times-a-day frustration for me and other users, with different ISPs, since approximately June 25. Is anyone working on this bug? Because it clearly is a bug: Not only I but several other users have reported that Thunderbird worked fine until that date, then stopped working fine. What changed, and can it be put back the way it was, or can we receive some explicit instructions on how to fix it for ourselves? It's making Thunderbird borderline unusable. Every time I try to send a message, I have to confirm a security exception, then send it again. Several times a day, when I try to fetch messages, I have to confirm security exceptions. The confirmations never seem to stick. This is some BS.