Search Support

Beware of phishing attacks: Mozilla will never ask you to call a number or visit a non-Mozilla website. Please ignore such requests.

Learn More

Statement on Firefox 33 and self-signed certificates

  • 2 回覆
  • 62 有這個問題
  • 435 次檢視
  • 最近回覆由 pion19

more options

Dear Mozilla,

Your decision to drop support for self-signed certificates is causing problems all around in LANs, VPNs, and domain networks both home and corporate which employ SSL but use self-signed certs. Despite it being understanding that it is generally ill-advised to access sites with such problems, further deciding that this minority of exceptions should be abandoned altogether in a world web full of so many shades of grey and complex setups is not a responsible decision.

Please implement methods for us to be able to coexist with these updates, as suddenly dropping support for the plenthora of routers, domains, websites and other sources using such a setup, many of which cannot be quickly updated or even at all, is a big problem.

The internet engineering taskforce has not issued any such directives, nor have broader plans to drop support for self-signed certificates been announced. In the lack of a transitioning climate away from this setup or any plans to do so, Mozilla has unilaterally decided to remove support.

Please remember that you have a large userbase and thus a responsibility to keep available means of access that are in common use by the world. Self-signed certificates still very much play a role in the ecosystem, and they will continue to exist for as long as there is a need for encryption on intranets.

Thank you!

All Replies (2)

more options

由 Fab de Coarraze 於 修改

more options

it seems the problem is not self-signed certificate itself, but too short (from current point of view) RSA-keys. Please see https://support.mozilla.org/en-US/questions/1045971

moreover, SSLv3 is now insecure, and is soon going to be disabled by default. https://blog.mozilla.org/security/2014/10/14/the-poodle-attack-and-the-end-of-ssl-3-0/

由 pion19 於 修改