Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Learn More

Firefox Root Certificate Expiration related issue w/ legacy add-ons & single website access

  • 3 respostas
  • 0 have this problem
  • 11 views
  • Last reply by agataloca

I'm on WinXP and Win7; FF is there respectively on ESR 52.6.0, and 56.0.2.

    • Pls refrain from lecturing me on updating etc. I need it to be this way for umpteen reasons. Thanks for understanding.**

First, all of a sudden all my legacy add-ons were disabled. Most of them ensure FF looks like it did ages ago, which is what I'm used to, and need, to function properly myself. They overall are no longer maintained or downloadable, hence the need to stay on lower browser versions as well.

Managed to fix that.

Then, last Fri, my webmail provider missed updating their security certificate. They seemingly later do, but I am left unable to access their website from FF on both machines, and Chrome on the XP. Disaster.

The error messages I get are, in FF:

[www.netaddress.com] uses an invalid security certificate.

The certificate is not trusted because the issuer certificate is unknown. The server might not be sending the appropriate intermediate certificates. An additional root certificate may need to be imported.

Error code: <a id="errorCode" title="SEC\\\\\\\\\\\\\\\_ERROR\\\\\\\\\\\\\\\_UNKNOWN\\\\\\\\\\\\\\\_ISSUER">SEC\_ERROR\_UNKNOWN\_ISSUER</a>

and in Chrome:

classic.netaddress.com normally uses encryption to protect your information. When Google Chrome tried to connect to classic.netaddress.com this time, the website sent back unusual and incorrect credentials. This may happen when an attacker is trying to pretend to be classic.netaddress.com, or a Wi-Fi sign-in screen has interrupted the connection. Your information is still secure because Google Chrome stopped the connection before any data was exchanged.

You cannot visit [classic.netaddress.com] right now because the website uses HSTS. Network errors and attacks are usually temporary, so this page will probably work later.

When running a SSL server test on their certificate it turned back: Chain issues Incorrect order, Contains anchor

No idea if that's relevant.

I tried just abt everything I was handed, could think of, or googled. Adding an exception included. Nothing works. Logically, the error should be on their end (w/ their old certificate, it all worked fine, now it doesn't), but somehow I keep being directed to that your root certificate having expired is the culprit.

Earlier today, I took the plunge and updated FF to 72.0.2 on the Win7 machine. (My webmail doesn't have full functionality on Chrome, so I was still very hampered in that regard there.) Now I can access the webmail -- but all my add-ons AGAIN are disabled. And what I did before to make the work does now NOT work anymore.

Can someone pls take me out of my misery? My whole existence is falling apart. I am already on 75 % (invisible) disability. Nothing works, least of all I. I am days behind on an already massively overburdened schedule. Not everyone can handle constant updates and their user interface being changed all the time. Some ppl are dependent on things looking and acting the exact same.

I'd like my add-ons back functional on the Win7 machine, and my webmail back -- INCLUDING the add-ons remaining functional, on the WinXP. Thank you.

I'm on WinXP and Win7; FF is there respectively on ESR 52.6.0, and 56.0.2. **Pls refrain from lecturing me on updating etc. I need it to be this way for umpteen reasons. Thanks for understanding.** First, all of a sudden all my legacy add-ons were disabled. Most of them ensure FF looks like it did ages ago, which is what I'm used to, and need, to function properly myself. They overall are no longer maintained or downloadable, hence the need to stay on lower browser versions as well. Managed to fix that. Then, last Fri, my webmail provider missed updating their security certificate. They seemingly later do, but I am left unable to access their website from FF on both machines, and Chrome on the XP. Disaster. The error messages I get are, in FF: [www.netaddress.com] uses an invalid security certificate. The certificate is not trusted because the issuer certificate is unknown. The server might not be sending the appropriate intermediate certificates. An additional root certificate may need to be imported. Error code: <a id="errorCode" title="SEC\\\\\\\\\\\\\\\_ERROR\\\\\\\\\\\\\\\_UNKNOWN\\\\\\\\\\\\\\\_ISSUER">SEC\_ERROR\_UNKNOWN\_ISSUER</a> and in Chrome: classic.netaddress.com normally uses encryption to protect your information. When Google Chrome tried to connect to classic.netaddress.com this time, the website sent back unusual and incorrect credentials. This may happen when an attacker is trying to pretend to be classic.netaddress.com, or a Wi-Fi sign-in screen has interrupted the connection. Your information is still secure because Google Chrome stopped the connection before any data was exchanged. You cannot visit [classic.netaddress.com] right now because the website uses HSTS. Network errors and attacks are usually temporary, so this page will probably work later. When running a SSL server test on their certificate it turned back: Chain issues Incorrect order, Contains anchor No idea if that's relevant. I tried just abt everything I was handed, could think of, or googled. Adding an exception included. Nothing works. Logically, the error should be on their end (w/ their old certificate, it all worked fine, now it doesn't), but somehow I keep being directed to that your root certificate having expired is the culprit. Earlier today, I took the plunge and updated FF to 72.0.2 on the Win7 machine. (My webmail doesn't have full functionality on Chrome, so I was still very hampered in that regard there.) Now I can access the webmail -- but all my add-ons AGAIN are disabled. And what I did before to make the work does now NOT work anymore. Can someone pls take me out of my misery? My whole existence is falling apart. I am already on 75 % (invisible) disability. Nothing works, least of all I. I am days behind on an already massively overburdened schedule. Not everyone can handle constant updates and their user interface being changed all the time. Some ppl are dependent on things looking and acting the exact same. I'd like my add-ons back functional on the Win7 machine, and my webmail back -- INCLUDING the add-ons remaining functional, on the WinXP. Thank you.

Chosen solution

SOLUTION

for WinXP & Win7/FF (not Chrome, but that's non-essential to me). Comment from member of SuperUser, where I also asked the q:

"Assuming www.netaddress.com is the real name and not a redaction, it is true they are sending the chain misordered, but Firefox (and other major browsers) has been able to handle that as long as I can remember (and since 2018 -- just after your Firefox versions -- TLS1.3 even makes it semiofficial).

A more likely problem is they are using this SSL.com root issued in mid-2017 (https://crt.sh/?id=163978581, there's a link to download file in the 1st column -- my note) which likely was not yet accepted in NSS as of your Firefox versions; look in Tools / Options / Advanced / Certificates / ViewCertificates / Authorities and if it's not there add it."

This can thus be closed (I don't see how to do it myself).

Ler a resposta no contexto 👍 0

All Replies (3)

Chosen Solution

SOLUTION

for WinXP & Win7/FF (not Chrome, but that's non-essential to me). Comment from member of SuperUser, where I also asked the q:

"Assuming www.netaddress.com is the real name and not a redaction, it is true they are sending the chain misordered, but Firefox (and other major browsers) has been able to handle that as long as I can remember (and since 2018 -- just after your Firefox versions -- TLS1.3 even makes it semiofficial).

A more likely problem is they are using this SSL.com root issued in mid-2017 (https://crt.sh/?id=163978581, there's a link to download file in the 1st column -- my note) which likely was not yet accepted in NSS as of your Firefox versions; look in Tools / Options / Advanced / Certificates / ViewCertificates / Authorities and if it's not there add it."

This can thus be closed (I don't see how to do it myself).

Helpful?

There's nothing any users here can do to help.

Helpful?

Well, obviously. That was my point. I just didn't see how to close it -- which I now do.

Helpful?

Ask a question

You must log in to your account to reply to posts. Please start a new question, if you do not have an account yet.