Search Support

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Learn More

Bitdefender: suspicious connection blocked involving Firefox - signature-2.cdn.mozilla.net

  • 10 uphendule
  • 1 inale nkinga
  • 27 views
  • Igcine ukuphendulwa ngu jscher2000

more options

Each morning, when I first cold boot my computer, the moment I open my Firefox browser, I receive numerous (10+) identical error messages from Bitdefender:

Suspicious connection blocked: Feature: Online Threat Prevention

firefox.exe attempted to establish a connection relying on an unmatching security certificate to content-signature-2.cdn.mozilla.net. We blocked the connection to keep your data safe since the used certificate was issued for a different web address than the targeted one.

Question: Is this ACTUALLY coming from Firefox? If so, please match your security certificates! If that's impossible due to a technical issue, then please email me your confirmation so that I can add an exception to Bitdefender.

Question: If it's not coming from Firefox, please email me, letting me know what additional system information you require so that we can get to the bottom of who/what is masquerading as Firefox while attempting to establish an unauthorized Internet connection from my computer.

HP Envy laptop, Windows 10 OS, latest update.

This has been occurring for several months.

Thank you for your time.

Ama-screenshot ananyekiwe

All Replies (10)

more options

Anyone? Hello...

Helpful?

more options

I don't think it's necessary for Bitdefender to terminate connections where the certificate doesn't match. Firefox does that all on its own, as you may have seen from time to time on the built-in secure connection error pages.

Anyway, since this connection can't work for anyone, I suggest ignoring it unless you discover that something important has stopped working in Firefox.

Helpful?

more options

Do you use a bookmark or are you starting with the main (home) page of this website?

If you use a bookmark to access a specific page then instead navigate to this page starting with the main page or with the sign in page in case there is a problem with this bookmark.

Helpful?

more options

cor-el said

Do you use a bookmark or are you starting with the main (home) page of this website? If you use a bookmark to access a specific page then instead navigate to this page starting with the main page or with the sign in page in case there is a problem with this bookmark.

Neither. I get roughly 23 identical error message pop-ups after booting my computer and opening Firefox. If I close down Firefox, the reopen it, I the 23 error messages begin again, so it's clearly tied to opening Firefox.

It does not matter which website I go to (news, weather, facebook, etc.). It always begins within a few seconds after opening Firefox.

Helpful?

more options

jscher2000 said

I don't think it's necessary for Bitdefender to terminate connections where the certificate doesn't match. Firefox does that all on its own, as you may have seen from time to time on the built-in secure connection error pages. Anyway, since this connection can't work for anyone, I suggest ignoring it unless you discover that something important has stopped working in Firefox.

Bitdefender claims its product is doing its job. Indeed, out of hundreds of other programs on my computer, not once has any other program attempted to access sites with mis-matched certificates.

If "Firefox does that all on its own," then perhaps it should stop doing something which one of the leading antivirus/security programs clearly sees as a threat.

"Ignoring it" is not an acceptable solution. This is a potentially harmful security issue. I'd like to see it resolved, not ignored.

Helpful?

more options

Thank you both for your replies. If either of you have anything more to add, by all means, please do so!

In the meantime, anyone else out there with insight on this issue? Please review the attachment at the OP. Thank you.

Helpful?

more options

That server seems to be used for content signatures to validate information that Firefox requests from Mozilla servers in the background: https://github.com/mozilla-services/autograph/blob/main/signer/contentsignaturepki/README.md

Do you get a secure connection error if you try to open this file:

https://content-signature-2.cdn.mozilla.net/chains/normandy.content-signature.mozilla.org-2020-05-05-15-04-19.chain

Expected result: download dialog

If I open the Browser Console before making the request, and enable listing requests by clicking "Requests" at the right end of the filter bar, I see the following certificate information:

If you got an error page, you can compare by clicking the Advanced button to view more details, and then clicking View Certificate.

Helpful?

more options

cor-el said

Do you use a bookmark or are you starting with the main (home) page of this website? If you use a bookmark to access a specific page then instead navigate to this page starting with the main page or with the sign in page in case there is a problem with this bookmark.

Only about 60% of the time. The rest of the time I'm opening Firefox direction from the link I pinned to the taskbar, and the issue remains the same, even after clean, cold boots. Ergo, it's associated with Firefox directly, not a bookmark.

Helpful?

more options

jscher2000 said

That server seems to be used for content signatures to validate information that Firefox requests from Mozilla servers in the background: https://github.com/mozilla-services/autograph/blob/main/signer/contentsignaturepki/README.md Do you get a secure connection error if you try to open this file: https://content-signature-2.cdn.mozilla.net/chains/normandy.content-signature.mozilla.org-2020-05-05-15-04-19.chain Expected result: download dialog If I open the Browser Console before making the request, and enable listing requests by clicking "Requests" at the right end of the filter bar, I see the following certificate information: If you got an error page, you can compare by clicking the Advanced button to view more details, and then clicking View Certificate.

Excellent page resource explaining content signatures, jscher2000. Thank you.

As for your results through the Browser Console, I am unable to duplicate your screen. Specifically, the browser opens the page displaying the three certificates, but the Browser Console displays:

Unchecked lastError value: Error: Could not establish connection. Receiving end does not exist.

When I click on the link (view-source:moz-extension://570c9611-b493-4a51-86e9-968b31b498db/background.js) in Browser Console to amplify, it brings up the following:

Helpful?

more options

Right, never mind on the Browser Console, that was the only way I could capture the cert information because a successful download doesn't show anything in a tab. What does the first certificate look like in your case? The Common Name is different?

Helpful?

Buza umbuzo

Kufanele ulogele ukungena ku-akhawunti yakho ukuze uphendule amaphosti. Uyacelwauqale umbuzo omusha, uma ungekabi nayo i-akhawunti namanje.