Tìm kiếm hỗ trợ

Tránh các lừa đảo về hỗ trợ. Chúng tôi sẽ không bao giờ yêu cầu bạn gọi hoặc nhắn tin đến số điện thoại hoặc chia sẻ thông tin cá nhân. Vui lòng báo cáo hoạt động đáng ngờ bằng cách sử dụng tùy chọn "Báo cáo lạm dụng".

Learn More

Firefox 101.1 Says "SSL_ERROR_BAD_CERT_DOMAIN"

  • 5 trả lời
  • 5 gặp vấn đề này
  • 3676 lượt xem
  • Trả lời mới nhất được viết bởi rpmurph83

more options

Getting error SSL_ERROR_BAD_CERT_DOMAIN on all my sites that are signed with a SSL Cert from my internal CA since updating past version 99

This appears to be a bug starting after Firefox version 99 on Windows because after i upgraded to Firefox version 100 i started getting this on all my SSL Certs from my CA and they worked fine prior to the update. Can anyone confirm if something changed after version 100 that is causing this?

Thank you.

Getting error SSL_ERROR_BAD_CERT_DOMAIN on all my sites that are signed with a SSL Cert from my internal CA since updating past version 99 This appears to be a bug starting after Firefox version 99 on Windows because after i upgraded to Firefox version 100 i started getting this on all my SSL Certs from my CA and they worked fine prior to the update. Can anyone confirm if something changed after version 100 that is causing this? Thank you.

Giải pháp được chọn

It must be due to removed "subject common name" fallback support from certificate validation. This fallback mode was previously enabled only for manually installed certificates. The CA Browser Forum Baseline Requirements have required the presence of the "subjectAltName" extension since 2012, and use of the subject common name was deprecated in RFC 2818.

Firefox from 101.0 onward no longer use certificate CN (Common Name) for matching domain name to certificate and have migrated to only using SAN (Subject Alternate Name) so if you self sign for internal devices you’ll need to regenerate.

Đọc câu trả lời này trong ngữ cảnh 👍 3

Tất cả các câu trả lời (5)

more options

Giải pháp được chọn

It must be due to removed "subject common name" fallback support from certificate validation. This fallback mode was previously enabled only for manually installed certificates. The CA Browser Forum Baseline Requirements have required the presence of the "subjectAltName" extension since 2012, and use of the subject common name was deprecated in RFC 2818.

Firefox from 101.0 onward no longer use certificate CN (Common Name) for matching domain name to certificate and have migrated to only using SAN (Subject Alternate Name) so if you self sign for internal devices you’ll need to regenerate.

Hữu ích?

more options

So I added the SAN to the newly generated cert because as you mentioned since the SAN is now required. However, now it comes back with Error code: "SEC_ERROR_UNKNOWN_ISSUER." What's weird is both Edge and Chrome were complaining about the cert prior to adding the SAN. Once it was added, Edge and Chrome stopped complaining, but Firefox is still throwing errors.

Hữu ích?

more options

I think the second issue was due to a corrupted Firefox profile. I completely removed Firefox, rebooted, reinstalled 101.1, and then synced my accounts and all appears to be good now since adding the SAN. Thanks again for the reminder about the SAN requirement.

Hữu ích?

more options

Note that it might have been sufficient to rename/remove cert9.db in the Firefox profile folder to cleanup the certificate storage.

Hữu ích?

more options

Thanks for the tip, that makes sense seeing the issue after generating the new cert with SAN. Definitely going in my OneNote!

Hữu ích?

Đặt một câu hỏi

Bạn phải đăng nhập vào tài khoản của bạn để trả lời bài viết. Vui lòng bắt đầu một câu hỏi mới, nếu bạn chưa có tài khoản.