Your connection is not secure
Hi Firefox folks,
Since about a month ago, I have been running to this "Your connection is not secure" error when connecting to my corporation's internal website (used to work before, though). And it won't let me add an exception.
The error message reads as follow:
The owner of supportfiles.emc.com has configured their website improperly. To protect your information from being stolen, Firefox has not connected to this website.
This site uses HTTP Strict Transport Security (HSTS) to specify that Firefox may only connect to it securely. As a result, it is not possible to add an exception for this certificate.
-----------------------------------------------------------------
And here is the detailed error info after I click the "Advanced" button and then the error code (MOZILLA_PKIX_ERROR_ADDITIONAL_POLICY_CONSTRAINT_FAILED):
An additional policy constraint failed when validating this certificate.
HTTP Strict Transport Security: true HTTP Public Key Pinning: false
Certificate chain:
BEGIN CERTIFICATE-----
MIIGZjCCBU6gAwIBAgIQSqVHwhtRvXXIlt8eVZC1FDANBgkqhkiG9w0BAQsFADBD MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMdGhhd3RlLCBJbmMuMR0wGwYDVQQDExR0 aGF3dGUgU0hBMjU2IFNTTCBDQTAeFw0xNjA0MTkwMDAwMDBaFw0xODA2MDEyMzU5 NTlaMIGdMQswCQYDVQQGEwJVUzEWMBQGA1UECAwNTWFzc2FjaHVzZXR0czESMBAG A1UEBwwJSG9wa2ludG9uMRgwFgYDVQQKDA9FTUMgQ29ycG9yYXRpb24xKTAnBgNV BAsMIEVudGVycHJpc2UgTWlkZGxld2FyZSBNYW5hZ2VtZW50MR0wGwYDVQQDDBRz dXBwb3J0ZmlsZXMuZW1jLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC ggEBAJWjNxJ3d8e91rCmmMcmRGJXFqsuXWId6YYm9hGOwH+YtbCvo70TRZTuD/ek atEoMBKWrCYlbjE6Y/aNaeiWOc92mT0/+5IzvwkRoeMTdLbX5Vtnb5D9aNkLQF2h s5bCAtudaTOoiwcuZMIwW7LxuxgQT6DNAaN8boXQ7IiZerzrI7sGKtB5Sf3wSIU6 bGf9dhPuuspcrJ6Eg3gT3J5bc9eJNaBgCHB3DpKBIyGObBbGH0KFWHLnMLfkwkhJ acbIxmrXK3/Da9GrNdT+nScUCNgFRlN2SkdMlPO5j8w2KdswPR0QvIPpba/ZFUxe 1VFrfd2upmPYoucpgGEYvViip78CAwEAAaOCAvkwggL1MB8GA1UdEQQYMBaCFHN1 cHBvcnRmaWxlcy5lbWMuY29tMAkGA1UdEwQCMAAwbgYDVR0gBGcwZTBjBgZngQwB AgIwWTAmBggrBgEFBQcCARYaaHR0cHM6Ly93d3cudGhhd3RlLmNvbS9jcHMwLwYI KwYBBQUHAgIwIwwhaHR0cHM6Ly93d3cudGhhd3RlLmNvbS9yZXBvc2l0b3J5MA4G A1UdDwEB/wQEAwIFoDAfBgNVHSMEGDAWgBQrmjWuARg4MOFwegXgEXajzr2QFDAr BgNVHR8EJDAiMCCgHqAchhpodHRwOi8vdGcuc3ltY2IuY29tL3RnLmNybDAdBgNV HSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwVwYIKwYBBQUHAQEESzBJMB8GCCsG AQUFBzABhhNodHRwOi8vdGcuc3ltY2QuY29tMCYGCCsGAQUFBzAChhpodHRwOi8v dGcuc3ltY2IuY29tL3RnLmNydDCCAX8GCisGAQQB1nkCBAIEggFvBIIBawFpAHYA 3esdK3oNT6Ygi4GtgWhwfi6OnQHVXIiNPRHEzbbsvswAAAFULg1UIwAABAMARzBF AiBiywMuHQPngCkluP7vqchiG0KKp3P7YoAys2MTVOBe5gIhAIQuuIl5yX6xY7/Y tmWRL4J2zbNY/fq8hw6Cnt3O87rdAHcApLkJkLQYWBSHuxOizGdwCjw1mAT5G9+4 43fNDsgN3BAAAAFULg1UYgAABAMASDBGAiEAsYfp2KlLIaGOg/Oo8kr21LyPSLnw l+WvxEquz8weE9cCIQDrHHcNm5A407khuHqR19HG8037YNAf5kDNc7C/bIghbwB2 AGj2mPgfZIK+OozuuSgdTPxxUV1nk9RE0QpnrLtPT/vEAAABVC4NVEIAAAQDAEcw RQIhALDSMMEZZUgCSOD4BtxmBElLJdllRoZMdykUljY59S/RAiAUTOGWj/HxrPpz OIzVYP3WOYs8P80bquj7qE0dkkYNVzANBgkqhkiG9w0BAQsFAAOCAQEAlBoFUKNw bLUXcIN+hNPsrJ0QtuUBD037nRilSr3QIJzscHrzigMDpIHabQ656sLE4OMJSY94 Qw1SiA8YS708fsYX5htBFkkZPcUJSTOS9vvRT+NXN36cOdNPojjyqt1HWM3yT5jw 0bZQqUOP1PfEh8Mvw8S2pZilWBBT87x2Vqlyoe3MEoP4yNSKafR2y8WaJlYDnMLD v8sybIBmdQZc/POOOZak7al5xKx8bjQxZYhCdKL2X3CYBqSy6ftiaYi4WBa2KSxM NCAw4iqaetChLUUPuPGyOLs8qKPNXyyn8cu8lvnP0h6NZ5nzDD8ZtdlL9+KzXHUo rxBysV7dePCOEA==
END CERTIFICATE-----
BEGIN CERTIFICATE-----
MIIEwjCCA6qgAwIBAgIQNjSeGMmcJmm2Vi5s5a1xMjANBgkqhkiG9w0BAQsFADCB rjELMAkGA1UEBhMCVVMxFTATBgNVBAoTDHRoYXd0ZSwgSW5jLjEoMCYGA1UECxMf Q2VydGlmaWNhdGlvbiBTZXJ2aWNlcyBEaXZpc2lvbjE4MDYGA1UECxMvKGMpIDIw MDggdGhhd3RlLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxJDAiBgNV BAMTG3RoYXd0ZSBQcmltYXJ5IFJvb3QgQ0EgLSBHMzAeFw0xMzA1MjMwMDAwMDBa Fw0yMzA1MjIyMzU5NTlaMEMxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwx0aGF3dGUs IEluYy4xHTAbBgNVBAMTFHRoYXd0ZSBTSEEyNTYgU1NMIENBMIIBIjANBgkqhkiG 9w0BAQEFAAOCAQ8AMIIBCgKCAQEAo2Mr1LpdOK6wz7lMON8gffErR3Edi2jzVvmc 2qrlhCbepXEwvPMxI53oO4DIZld1tlcO25P1Jo5wumRSZooqiFxEGE2oony9VmEy kBL5NYdIYLBukGdEAY3nyQ1jaHJyq2M8hrgffa2IJadqiCn7WcZ4cV8suonm04D9 V+y5UV9DMy5+JTukBNFgjLNEM5MMrSq2RKIZO6/EkG97BYeGmyxqnStsd8kAn8nP rO0+G/fD89n4bNSgV8T7KDKqM/Dmupjf5cJOnHS/ikjC8hvwd0BBBwSyOtVMxCmp EUA/AkbwkdXSgYOGE7Mx7UarqId2qZl9vM0xUPSltdylMrOLiwIDAQABo4IBRDCC AUAwMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUFBzABhhZodHRwOi8vb2NzcC50aGF3 dGUuY29tMBIGA1UdEwEB/wQIMAYBAf8CAQAwQQYDVR0gBDowODA2BgpghkgBhvhF AQc2MCgwJgYIKwYBBQUHAgEWGmh0dHBzOi8vd3d3LnRoYXd0ZS5jb20vY3BzMDcG A1UdHwQwMC4wLKAqoCiGJmh0dHA6Ly9jcmwudGhhd3RlLmNvbS9UaGF3dGVQQ0Et RzMuY3JsMA4GA1UdDwEB/wQEAwIBBjAqBgNVHREEIzAhpB8wHTEbMBkGA1UEAxMS VmVyaVNpZ25NUEtJLTItNDE1MB0GA1UdDgQWBBQrmjWuARg4MOFwegXgEXajzr2Q FDAfBgNVHSMEGDAWgBStbKqUYJzt5P/6Pgp0K2MD97ZZvzANBgkqhkiG9w0BAQsF AAOCAQEAdKZW6K+Tlhn7JvkNsESlzel6SAN0AWwTcbfggpCZYiPj1pmv8McenqgY Idu0lD80VhuZVS+O8EUzMrdywRNbNNP1YOUuGNFcxWrBqodQDBydZCv/G9zVLmEL 57m2kVOG2QMq0T17StorB74p8mBCqZEaDi480X2lExQC+u6LjbbIuD5WgVchJD9l w7TJzlyNRqxT8/lVdMgr/dJ4cPX4EeX0p60g9Z3x7HD2E6zmjI3bP8byeQ6rUvLM G3knzxaz1vPGNoBD7MWU8N2QjfjGUkZW63RHvqbzGa5xTMDh59TP7dQGKCoRPLrZ QW4A54E3k+TaYsYdZ29jtBSG2aZi8A==
END CERTIFICATE-----
Note that I have already set security.enterprise_roots.enabled to true, after reading several Mozilla community threads, but this does not seem to work.
Please kindly let me know if there is a fix. Thank you!
Tutte le risposte (6)
There is security software like Avast, Kaspersky, BitDefender and ESET that intercept secure connections and send their own certificate.
https://support.mozilla.org/en-US/kb/firefox-cant-load-websites-other-browsers-can
https://support.mozilla.org/en-US/kb/firefox-and-other-browsers-cant-load-websites
https://support.mozilla.org/en-US/kb/secure-connection-failed-error-message
https://support.mozilla.org/en-US/kb/connection-untrusted-error-message
http://kb.mozillazine.org/Error_loading_websites
- uses an invalid security certificate SSL_ERROR_BAD_CERT_DOMAIN
- configured their website improperly
How to troubleshoot the error code "SEC_ERROR_UNKNOWN_ISSUER" on secure websites https://support.mozilla.org/en-US/kb/troubleshoot-SEC_ERROR_UNKNOWN_ISSUER
This means that Firefox blocks this certificate as part of distrusting all certificate issues by Symantec. The website will have to get a new certificate.
This block has been enabled in Beta and Nightly, so you will have to use the current release to access website that give this specific SSL error code.
You can consider to contact the website and point them to the this blog post.
cor-el said
This means that Firefox blocks this certificate as part of distrusting all certificate issues by Symantec. The website will have to get a new certificate. This block has been enabled in Beta and Nightly, so you will have to use the current release to access website that give this specific SSL error code. You can consider to contact the website and point them to the this blog post.
Thanks cor-el! I think I might be hitting this Symantec issue... I found my internal website's certificate is issued by "thawte"--didn't realize this was from Symantec until I saw your reply and googled... will be considering downgrading my browser to none-Beta or Nightly version.
FredMcD said
There is security software like Avast, Kaspersky, BitDefender and ESET that intercept secure connections and send their own certificate. https://support.mozilla.org/en-US/kb/firefox-cant-load-websites-other-browsers-can https://support.mozilla.org/en-US/kb/firefox-and-other-browsers-cant-load-websites https://support.mozilla.org/en-US/kb/secure-connection-failed-error-message https://support.mozilla.org/en-US/kb/connection-untrusted-error-message http://kb.mozillazine.org/Error_loading_websitesHow to troubleshoot the error code "SEC_ERROR_UNKNOWN_ISSUER" on secure websites https://support.mozilla.org/en-US/kb/troubleshoot-SEC_ERROR_UNKNOWN_ISSUER
- uses an invalid security certificate SSL_ERROR_BAD_CERT_DOMAIN
- configured their website improperly
Thanks for the links FredMcD. Although I think my issue was more likely caused by the Symantec CA...
templarares said
FredMcD saidThere is security software like Avast, Kaspersky, BitDefender and ESET that intercept secure connections and send their own certificate. https://support.mozilla.org/en-US/kb/firefox-cant-load-websites-other-browsers-can https://support.mozilla.org/en-US/kb/firefox-and-other-browsers-cant-load-websites https://support.mozilla.org/en-US/kb/secure-connection-failed-error-message https://support.mozilla.org/en-US/kb/connection-untrusted-error-message http://kb.mozillazine.org/Error_loading_websitesHow to troubleshoot the error code "SEC_ERROR_UNKNOWN_ISSUER" on secure websites https://support.mozilla.org/en-US/kb/troubleshoot-SEC_ERROR_UNKNOWN_ISSUER
- uses an invalid security certificate SSL_ERROR_BAD_CERT_DOMAIN
- configured their website improperly
Thanks for the links FredMcD. Although I think my issue was more likely caused by the Symantec CA...
I downloaded my firefox to current release (59.0.2) and the error is gone! Thanks again FredMcD!
Hello,
I am glad to hear that your problem has been resolved. If you haven't already, please select the answer that solves the problem. This will help other users with similar problems find the solution more easily.
Thank you for contacting Mozilla Support.