X
點擊此處開啟此網站的行動版。

技術支援討論區

Secure Connection Failed after updating to wildcard security certificate

已張貼

I run ecommerce site, which was using standard ‘Positive SSL’ using the following SSLCipherSuite ALL:!ADH:+HIGH:+MEDIUM:+SSLv2:+EXP.

I’ve not had a problem with Firefox users accessing the site, but today, I removed the Positive SSL cert and replaced it with a ‘Positive Wildcard SSL’

The site is fine with other browsers but when testing on Firefox (no other changes made) I get the following error: --- Secure Connection Failed An error occurred during a connection to www.sussexcookers.com. Cannot communicate securely with peer: no common encryption algorithm(s). (Error code: ssl_error_no_cypher_overlap) The page you are trying to view cannot be shown because the authenticity of the received data could not be verified. Please contact the web site owners to inform them of this problem. --- Now I’m obviously the site owner – and I suspect I will be contacted by my users shortly! So I want to address this problem for them. So any help is appreciated!

Now I concluded that – after performing clean install of Firefox on test machine, that the problem is related to SSLCipherSuite, I tried implementing a number of CipherSuites which corrected the problem on test machine, but doesn’t fix the problem for customers who have already visited the site and are returning. The problem is still present on my main development machine and second test machine I use. I’m currently running the following CipherSuite as specified by the Wiki: https://wiki.mozilla.org/Security/Server_Side_TLS ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA

Is this a bug or is there setting I need to change to address this problem. At the moment I fear that anyone who as viewed my site in Firefox prior the certificate change won’t be able to view the site with the new certificate unless they re-install Firefox or rinse the certificate database. Which is not viable steps for my average customer.

Any help or advice would be super appreciated thanks!

I run ecommerce site, which was using standard ‘Positive SSL’ using the following SSLCipherSuite ALL:!ADH:+HIGH:+MEDIUM:+SSLv2:+EXP. I’ve not had a problem with Firefox users accessing the site, but today, I removed the Positive SSL cert and replaced it with a ‘Positive Wildcard SSL’ The site is fine with other browsers but when testing on Firefox (no other changes made) I get the following error: --- Secure Connection Failed An error occurred during a connection to www.sussexcookers.com. Cannot communicate securely with peer: no common encryption algorithm(s). (Error code: ssl_error_no_cypher_overlap) The page you are trying to view cannot be shown because the authenticity of the received data could not be verified. Please contact the web site owners to inform them of this problem. --- Now I’m obviously the site owner – and I suspect I will be contacted by my users shortly! So I want to address this problem for them. So any help is appreciated! Now I concluded that – after performing clean install of Firefox on test machine, that the problem is related to SSLCipherSuite, I tried implementing a number of CipherSuites which corrected the problem on test machine, but doesn’t fix the problem for customers who have already visited the site and are returning. The problem is still present on my main development machine and second test machine I use. I’m currently running the following CipherSuite as specified by the Wiki: https://wiki.mozilla.org/Security/Server_Side_TLS ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA Is this a bug or is there setting I need to change to address this problem. At the moment I fear that anyone who as viewed my site in Firefox prior the certificate change won’t be able to view the site with the new certificate unless they re-install Firefox or rinse the certificate database. Which is not viable steps for my average customer. Any help or advice would be super appreciated thanks!

額外的系統細節

已安裝的外掛程式

  • The plugin allows you to have a better experience with Microsoft Lync
  • The plugin allows you to have a better experience with Microsoft SharePoint
  • Shockwave Flash 18.0 r0
  • 5.1.30514.0

應用程式

  • User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:41.0) Gecko/20100101 Firefox/41.0

更多資訊

guigs 1072 個解決方法 11697 個答案

I might suggest getting in touch with the security devs at mozilla in this email list: https://lists.mozilla.org/listinfo/dev-security-policy

They can help with expertise on the Mozilla certificate policy.

I might suggest getting in touch with the security devs at mozilla in this email list: [https://lists.mozilla.org/listinfo/dev-security-policy] They can help with expertise on the Mozilla certificate policy.
jscher2000
  • Top 10 Contributor
8758 個解決方法 71663 個答案

I don't understand why users who had visited the site before would have a problem with the new certificate. Could it have been a transient caching issue? Has anyone complained?

I don't understand why users who had visited the site before would have a problem with the new certificate. Could it have been a transient caching issue? Has anyone complained?
cor-el
  • Top 10 Contributor
  • Moderator
17527 個解決方法 158475 個答案

A server check shows a "Chain issues: Contains anchor" warning message (i.e. the server sends a root certificate).

I see that only TLS 1.2 is supported, so uses of older browsers that can't update for some reason fall off.

A server check shows a "Chain issues: Contains anchor" warning message (i.e. the server sends a root certificate). *https://www.ssllabs.com/ssltest/analyze.html?d=sussexcookers.com&latest I see that only TLS 1.2 is supported, so uses of older browsers that can't update for some reason fall off.