Avatar for Username

Search Support

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Learn More

This thread was archived. Please ask a new question if you need help.

Few days ago (after an update) FF simply refused to accept my self-signed certificate anymore

  • 2 replies
  • 1 has this problem
  • 227 views
  • Last reply by KpuCko

KpuCko
KpuCko
more options

Hello, Few days ago I noticed that Firefox started complaining about self-signed certificate issues, although I added my CA certificate to authorities months ago. It worked without any problem, but now I'm unable to open any of my internal sites anymore.

I tried to open a random site in Chrome, but the same issue. So you immediately will say the is in the certificate, but wait. I have few VMs running on Virtualbox, so I decided to test in there. Guess what, no issues at all. I tried in Fedora 25 (the Firefox version is below 100), then tried Windows 100. Both worked. Then I decided to update FF to the latest version, guess what - it broke again =]]

So something has changed, but I really don't have a clue what causes the issue. I attach the screenshot of detailed CA view from Firefox.

Hello, Few days ago I noticed that Firefox started complaining about self-signed certificate issues, although I added my CA certificate to authorities months ago. It worked without any problem, but now I'm unable to open any of my internal sites anymore. I tried to open a random site in Chrome, but the same issue. So you immediately will say the is in the certificate, but wait. I have few VMs running on Virtualbox, so I decided to test in there. Guess what, no issues at all. I tried in Fedora 25 (the Firefox version is below 100), then tried Windows 100. Both worked. Then I decided to update FF to the latest version, guess what - it broke again =]] So something has changed, but I really don't have a clue what causes the issue. I attach the screenshot of detailed CA view from Firefox.
Attached screenshots

Chosen solution

It must be due to removed "subject common name" fallback support from certificate validation. This fallback mode was previously enabled only for manually installed certificates. The CA Browser Forum Baseline Requirements have required the presence of the "subjectAltName" extension since 2012, and use of the subject common name was deprecated in RFC 2818.

Firefox from 101.0 onward no longer use certificate CN (Common Name) for matching domain name to certificate and have migrated to only using SAN (Subject Alternate Name) so if you self sign for internal devices you’ll need to regenerate.

Read this answer in context 👍 1

All Replies (2)

TyDraniu
TyDraniu
  • Top 25 Contributor
more options

Chosen Solution

It must be due to removed "subject common name" fallback support from certificate validation. This fallback mode was previously enabled only for manually installed certificates. The CA Browser Forum Baseline Requirements have required the presence of the "subjectAltName" extension since 2012, and use of the subject common name was deprecated in RFC 2818.

Firefox from 101.0 onward no longer use certificate CN (Common Name) for matching domain name to certificate and have migrated to only using SAN (Subject Alternate Name) so if you self sign for internal devices you’ll need to regenerate.

Modified by TyDraniu

KpuCko
KpuCko Question owner
more options

Hm, I think I saw something like "Subject Alternate Name" when I opened an internal site in Chrome.

So, let's see do I get it right - I need to recreate the CA certificate but instead using CN, I have to use SAN, right? The rest is the same?

What this means, will I be able to use again wildcard certificates for my internal sites, or I have to issue personal certificate for every site with specified SAN?

Sorry for my newbie questions, but I'm not certificate guru ;-=)

Modified by KpuCko