SEC_ERROR_UNKNOWN_ISSUER error on Google sites on OS X (Sierra)
Hi everyone, For the last several days I have had recurring, intermittent SEC_ERROR_UNKNOWN_ISSUER errors when accessing Google sites (www.google.com, mail.google.com, maps.google.com, etc.) with Firefox 57 on OS X Sierra. Other HTTPS sites (e.g., yahoo, facebook, reddit) are not affected, and Google sites are accessible via Safari, and via Firefox 57 on Windows 7 in Parallels.
What's especially confusing is that the problem is intermittent. At various times some or all Google domains will become accessible again in Firefox on OSX (e.g., earlier today www.google.com was accessible, but mail.google.com was not; later on, all google domains were accessible; now none are again). This is true even within the same browser session (i.e., without closing Firefox).
Troubleshooting suggestions found elsewhere have not helped: (1) System time and time zone are correct (2) No antivirus, filtering, etc. software are installed (3) No recent changes to OSX firewall, networking configurations, etc. (4) Changing networks (e.g., at home, at work, on mobile) has no effect: the error is everywhere (5) Uninstallation (i.e., trashing Firefox from Applications) and reinstallation has no effect (6) Running Firefox in safe mode has no effect
I've included more details further below. I feel like I'm slowly losing my mind, so I'd very much appreciate any suggestions.
Thank you all!
Regards, Douglas
Firefox version: 57.0.4 (64-bit)
OS X version: 10.12.6 (Sierra)
Checking certificates for https://mail.google.com at chrome://pippki/content/exceptionDialog.xul returns the below: Certificate status: This site attempts to identify itself with invalid information. Unknown identity This certificate is not trusted because it hasn't been verified as issued by a trusted authority using a secure signature.
Screenshots of the certificate details are attached.
Example error message
Your connection is not secure
The owner of www.google.com has configured their website improperly. To protect your information from being stolen, Firefox has not connected to this website.
This site uses HTTP Strict Transport Security (HSTS) to specify that Firefox may only connect to it securely. As a result, it is not possible to add an exception for this certificate.
www.google.com uses an invalid security certificate.
The certificate is not trusted because the issuer certificate is unknown. The server might not be sending the appropriate intermediate certificates. An additional root certificate may need to be imported.
Error code: SEC_ERROR_UNKNOWN_ISSUER
https://www.google.com/?gws_rd=ssl
Peer’s Certificate issuer is not recognized.
HTTP Strict Transport Security: false HTTP Public Key Pinning: true
Certificate chain:
BEGIN CERTIFICATE-----
MIIDuzCCAqOgAwIBAgIIZbQAduIAnFIwDQYJKoZIhvcNAQELBQAwSTELMAkGA1UE BhMCVVMxEzARBgNVBAoTCkdvb2dsZSBJbmMxJTAjBgNVBAMTHEdvb2dsZSBJbnRl cm5ldCBBdXRob3JpdHkgRzIwHhcNMTgwMTEwMDkzOTAwWhcNMTgwNDA0MDkzOTAw WjBoMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwN TW91bnRhaW4gVmlldzETMBEGA1UECgwKR29vZ2xlIEluYzEXMBUGA1UEAwwOd3d3 Lmdvb2dsZS5jb20wWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARiG/dZRdcEvLXG kiG21fvKgk0IzjJTNsmmG0h8t3dL/43rFbrCfo01us65WCi3hcVYl0U1SFUSOTUJ VsoxXxkCo4IBUTCCAU0wEwYDVR0lBAwwCgYIKwYBBQUHAwEwDgYDVR0PAQH/BAQD AgeAMBkGA1UdEQQSMBCCDnd3dy5nb29nbGUuY29tMGgGCCsGAQUFBwEBBFwwWjAr BggrBgEFBQcwAoYfaHR0cDovL3BraS5nb29nbGUuY29tL0dJQUcyLmNydDArBggr BgEFBQcwAYYfaHR0cDovL2NsaWVudHMxLmdvb2dsZS5jb20vb2NzcDAdBgNVHQ4E FgQU2ZfN51KH88xcNHcBLv2Yx1K11zgwDAYDVR0TAQH/BAIwADAfBgNVHSMEGDAW gBRK3QYWG7z2aLV29YG2u2IaulqBLzAhBgNVHSAEGjAYMAwGCisGAQQB1nkCBQEw CAYGZ4EMAQICMDAGA1UdHwQpMCcwJaAjoCGGH2h0dHA6Ly9wa2kuZ29vZ2xlLmNv bS9HSUFHMi5jcmwwDQYJKoZIhvcNAQELBQADggEBACYUDB6V3tgmqD2dYqcpMHBM 11EjtwxYPJVrYGkSO0nBRq3WV6nFScuxu2yaku9Xs/YejYQdXhwQb99xbiYEFSeL vEE+dD2Iu6/cIotquH5Y0t9T+WnGy98dB0g0n2GhGD24bAe+hH/eDuorR05nMkTh /rhxc8GRaoQFJIA2tjukFPhN08iPgqtlpfRlk27FEVA/6nPj76mtZNOm6PifZLmM 8QOMQjC66ibrSb0fc1nYS0S1BP+FK5sHYLLBbOdH8ysILd+r7D+v2g7ZF9mOnyN7 5+bzVoK+VLR/EwE4EERL/+h2yzIW5sjPFuIyTfVTZvM72q8nj3pgZtS4+kjO4tw=
END CERTIFICATE-----
BEGIN CERTIFICATE-----
MIIEKDCCAxCgAwIBAgIQAQAhJYiw+lmnd+8Fe2Yn3zANBgkqhkiG9w0BAQsFADBC MQswCQYDVQQGEwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEbMBkGA1UEAxMS R2VvVHJ1c3QgR2xvYmFsIENBMB4XDTE3MDUyMjExMzIzN1oXDTE4MTIzMTIzNTk1 OVowSTELMAkGA1UEBhMCVVMxEzARBgNVBAoTCkdvb2dsZSBJbmMxJTAjBgNVBAMT HEdvb2dsZSBJbnRlcm5ldCBBdXRob3JpdHkgRzIwggEiMA0GCSqGSIb3DQEBAQUA A4IBDwAwggEKAoIBAQCcKgR3XNhQkToGo4Lg2FBIvIk/8RlwGohGfuCPxfGJziHu Wv5hDbcyRImgdAtTT1WkzoJile7rWV/G4QWAEsRelD+8W0g49FP3JOb7kekVxM/0 Uw30SvyfVN59vqBrb4fA0FAfKDADQNoIc1Fsf/86PKc3Bo69SxEE630k3ub5/DFx +5TVYPMuSq9C0svqxGoassxT3RVLix/IGWEfzZ2oPmMrhDVpZYTIGcVGIvhTlb7j gEoQxirsupcgEcc5mRAEoPBhepUljE5SdeK27QjKFPzOImqzTs9GA5eXA37Asd57 r0Uzz7o+cbfe9CUlwg01iZ2d+w4ReYkeN8WvjnJpAgMBAAGjggERMIIBDTAfBgNV HSMEGDAWgBTAephojYn7qwVkDBF9qn1luMrMTjAdBgNVHQ4EFgQUSt0GFhu89mi1 dvWBtrtiGrpagS8wDgYDVR0PAQH/BAQDAgEGMC4GCCsGAQUFBwEBBCIwIDAeBggr BgEFBQcwAYYSaHR0cDovL2cuc3ltY2QuY29tMBIGA1UdEwEB/wQIMAYBAf8CAQAw NQYDVR0fBC4wLDAqoCigJoYkaHR0cDovL2cuc3ltY2IuY29tL2NybHMvZ3RnbG9i YWwuY3JsMCEGA1UdIAQaMBgwDAYKKwYBBAHWeQIFATAIBgZngQwBAgIwHQYDVR0l BBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA0GCSqGSIb3DQEBCwUAA4IBAQDKSeWs 12Rkd1u+cfrP9B4jx5ppY1Rf60zWGSgjZGaOHMeHgGRfBIsmr5jfCnC8vBk97nsz qX+99AXUcLsFJnnqmseYuQcZZTTMPOk/xQH6bwx+23pwXEz+LQDwyr4tjrSogPsB E4jLnD/lu3fKOmc2887VJwJyQ6C9bgLxRwVxPgFZ6RGeGvOED4Cmong1L7bHon8X fOGLVq7uZ4hRJzBgpWJSwzfVO+qFKgE4h6LPcK2kesnE58rF2rwjMvL+GMJ74N87 L9TQEOaWTPtEtyFkDbkAlDASJodYmDkFOA/MgkgMCkdm7r+0X8T/cKjhf4t5K7hl MqO5tzHpCvX2HzLc
END CERTIFICATE-----
BEGIN CERTIFICATE-----
MIIDfTCCAuagAwIBAgIDErvmMA0GCSqGSIb3DQEBBQUAME4xCzAJBgNVBAYTAlVT MRAwDgYDVQQKEwdFcXVpZmF4MS0wKwYDVQQLEyRFcXVpZmF4IFNlY3VyZSBDZXJ0 aWZpY2F0ZSBBdXRob3JpdHkwHhcNMDIwNTIxMDQwMDAwWhcNMTgwODIxMDQwMDAw WjBCMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEbMBkGA1UE AxMSR2VvVHJ1c3QgR2xvYmFsIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB CgKCAQEA2swYYzD99BcjGlZ+W988bDjkcbd4kdS8odhM+KhDtgPpTSEHCIjaWC9m OSm9BXiLnTjoBbdqfnGk5sRgprDvgOSJKA+eJdbtg/OtppHHmMlCGDUUna2YRpIu T8rxh0PBFpVXLVDviS2Aelet8u5fa9IAjbkU+BQVNdnARqN7csiRv8lVK83Qlz6c JmTM386DGXHKTubU1XupGc1V3sjs0l44U+VcT4wt/lAjNvxm5suOpDkZALeVAjmR Cw7+OC7RHQWa9k0+bw8HHa8sHo9gOeL6NlMTOdReJivbPagUvTLrGAMoUgRx5asz PeE4uwc2hGKceeoWMPRfwCvocWvk+QIDAQABo4HwMIHtMB8GA1UdIwQYMBaAFEjm aPkr0rKV10fYIyAQTzOYkJ/UMB0GA1UdDgQWBBTAephojYn7qwVkDBF9qn1luMrM TjAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjA6BgNVHR8EMzAxMC+g LaArhilodHRwOi8vY3JsLmdlb3RydXN0LmNvbS9jcmxzL3NlY3VyZWNhLmNybDBO BgNVHSAERzBFMEMGBFUdIAAwOzA5BggrBgEFBQcCARYtaHR0cHM6Ly93d3cuZ2Vv dHJ1c3QuY29tL3Jlc291cmNlcy9yZXBvc2l0b3J5MA0GCSqGSIb3DQEBBQUAA4GB AHbhEm5OSxYShjAGsoEIz/AIx8dxfmbuwu3UOx//8PDITtZDOLC5MH0Y0FWDomrL NhGc6Ehmo21/uBPUR/6LWlxz/K7ZGzIZOKuXNBSqltLroxwUCEm2u+WR74M26x1W b8ravHNjkOR/ez4iyz0H7V84dJzjA1BOoa+Y7mHyhD8S
END CERTIFICATE-----
End example error message
Tất cả các câu trả lời (2)
Sorry, the error message is likely not identifying the core issue. There have been problems with Google OCSP server responses the past couple of days. You could try this:
(1) In a new tab, type or paste about:config in the address bar and press Enter/Return. Click the button promising to be careful or accepting the risk.
(2) In the search box above the list, type or paste ocsp and pause while the list is filtered
(3) If the security.OCSP.require preference is bolded and "modified" or "user set" to true, double-click it to restore the default value of false
You may need to reload your Google page bypassing the cache, using either:
- Shift+click the reload button
- Ctrl+Shift+r (on Mac Command+Shift+r)
To clarify, this does not completely disable checking whether a certificate is revoked. There are two different preferences:
- security.OCSP.enabled = 1 (default setting) requires Firefox to check the cert with the OCSP server to make sure it hasn't been revoked
- security.ocsp.require determines what happens if the OCSP server does not respond
- false (default setting) treats the cert as not revoked and you can connect normally
- true treats the cert as revoked and prevents you from connecting
I suppose your choice about "require" depends on how often you expect to encounter a server with a revoked certificate and a nonresponsive OCSP server. I think the risk is low, but then, I may not be as adventurous in my browsing as you are.
Thank you!
I'll change this setting the next time it occurs and report back on whether it resolves the issue. Currently Google sites are working for me again, so I can't confirm right now.
In any event, you are correct that my security.ocsp.require is set to true. This setting is also set to false on my Windows 7 installation (where I have not had the issue), so the combination is consistent with Google OCSP being the cause.
I'll follow up.