I-Firefox Isithangami Sokwesekwa

The error: SEC_ERROR_UNKNOWN_ISSUER.

The certificates use sha256 for their signature algorithm.

Chrome and Edge both see the certificates as valid.

This is a recent change, I believe starting with Firefox 55.

Thanks for any help with this!

Periodically when Firefox is updated, it starts rejecting Yahoo Mail from loading, giving the "Your connection is not secure" / SEC_ERROR_UNKNOWN_ISSUER error. Unfortunately, it does not give you the option to add an exception, which clears up the problem most of the time.

Today this happened again with no ability to add an exception, and after looking at various websites for hours, trying to find a fix, I stumbled on one: Having Firefox "...automatically search for and import CAs that have been added to the Windows certificate store by a user or administrator." These are root certificates which you've manually imported. If you understood that last sentence, then it means you've probably done it on your computer; I know I have. The steps to fix it are these, and I cite the original web page further below:

- Open a new window in Firefox and type "about:config" without the quotes and hit enter - Confirm that you want to continue - In the search field, type in security.enterprise_roots.enabled and hit enter - you'll be left with one field - If it's marked as "false" then double-clicking it should turn it to "true" - Close the window, then go back to your Yahoo email login and try again. For me, this worked *perfectly*!

Here's the site where I found the info, under the "Experimental Built-in Windows Support" section: https://wiki.mozilla.org/CA:AddRootToFirefox

Good luck - I hope this helps to fix your Yahoo email login problem, too!

Yesterday I installed FF 43.0 - 64bit. I did as clean install as I could, uninstalled old version, and deleted from HDD every "mozilla" and "firefox" directory I could find. Since then, I am unable to access next sites (I believe list is not complete): https://www.google.com/ https://www.facebook.com/ https://www.google.com/maps https://www.google.rs/?gws_rd=ssl

Error msg is alwaays the same: "You have asked Firefox to connect securely to www.google.com, but we can't confirm that your connection is secure. Normally, when you try to connect securely, sites will present trusted identification to prove that you are going to the right place. However, this site's identity can't be verified. What Should I Do? If you usually connect to this site without problems, this error could mean that someone is trying to impersonate the site, and you shouldn't continue. This site uses HTTP Strict Transport Security (HSTS) to specify that Firefox only connect to it securely. As a result, it is not possible to add an exception for this certificate. Technical details: www.google.com uses an invalid security certificate. The certificate is not trusted because the issuer certificate is unknown. The server might not be sending the appropriate intermediate certificates. An additional root certificate may need to be imported. (Error code: sec_error_unknown_issuer)"

Sites that I can normaly access with this FF are: https://support.mozilla.org/en-US/ https://translate.google.com/ https://mail.google.com/

All other browsers can access all sites without problems.

I just installed FF 63 on a 64-bit Windows 7 machine, and I'm getting SEC_ERROR_UNKNOWN_ISSUER errors at many, but not all, websites. Reaching the same websites via the same URLs using Chrome works fine.

All discussions of this problem seem to lead to https://support.mozilla.org/en-US/kb/error-codes-secure-websites?redirectlocale=en-US&redirectslug=troubleshoot-SEC_ERROR_UNKNOWN_ISSUER, but it's not helpful. My antivirus is Bitdefender Free, which appears to have no option for disabling the interception of secure connections.

Running FF in safe mode behaves the same as in "normal" mode: I get SEC_ERROR_UNKNOWN_ISSUER errors at many (but not all) websites.

Help? As things stand now, FF is pretty close to useless for me.

I'm on the Sony Vaio, using Mozilla Firefox but I keep getting this error on the majority of websites.

Where is this coming from and how can I fix it?

Any help would be gratefully received.

I also have Bit Defender (in case this has anything to do with it).

I do not have Avast, Kaspersky, or ESET, and every website on Firefox Quantum shows a "Your Connection is Not Secure" error.

Error code: SEC_ERROR_UNKNOWN_ISSUER

www.google.com uses an invalid security certificate. The certificate is not trusted because the issuer certificate is unknown. The server might not be sending the appropriate intermediate certificates. An additional root certificate may need to be imported.

support.mozilla.org uses an invalid security certificate. The certificate is not trusted because the issuer certificate is unknown. The server might not be sending the appropriate intermediate certificates. An additional root certificate may need to be imported. Error code: SEC_ERROR_UNKNOWN_ISSUER

after a windows 10 update last night/this morning, getting above error on just about every site in Firefox and Chrome, but not Microsoft Edge. Any help appreciated.

In short, I want to be able to bypass certificate warnings.

Yes, I've seen this: https://support.mozilla.org/en-US/questions/1169632 "When there is HSTS(HTTPS Strict Transport Security) set on the server, you cannot add a exception"

In less short, my case (because one needs to always justify one's methods), I set up a subdomain on a separate IP/host and I'm trying to test some project for which I use a webpage as a small visible part. However, the domain uses HSTS (HSTS == very nice).

However, I'm just casually testing something using a subdomain (or even a fake domain, or a real domain pointing to a new server being prepared, maybe using /etc/hosts) pointing to an external or internal IP on some old computer on my LAN or even on my own computer. And that's not possible anymore.

People should always have the option to bypass a warning, and I'm all for the warnings. If anything, there shouldn't have been a box with the option "always remember" ticked by default. There are other cases where this can be useful, some we don't even know yet.

Since some time I get the error code "SEC_ERROR_UNKNOWN_ISSUER" on reliable websites. But it is not possible anymore to add an exception as described in https://support.mozilla.org/en-US/kb/troubleshoot-SEC_ERROR_UNKNOWN_ISSUER?as=u&utm_source=inproduct. Is the outdated info??? So, the only way to use these websites is to use another browser. What's going on here?

Hi. I'm trying to log on to a particular company's website and keep getting the message :

"The requested URL was rejected. Please consult with your administrator. Your support ID is: 11373612934950299921" (with a different number each time)

I've cleared my histories, cache and cookies. My Firefox updates itself.

Going to other sites is fine.

I've spoken to the company, they don't know what's happened and are not having this problem themselves or with any other customers.

Which administrator might it be referring to? Can anyone help? (I'm not sure whether to click on 'Share Data' below; let me know if this would be helpful.) Many thanks.

Was there a recent change that invalidates private certificates, with it's private CA imported into my FF CA repository?

What I have set up, which worked not too long ago, which was defining the IP address and host name in C:\Windows\System32\drivers\etc\hosts file. Then importing the remote site's private CA certificate in FF. From that point on, it trusted my private URLs due to matching private CA. Now, generates SEC_ERROR_BAD_SIGNATURE.

I renamed the cert8.db file and restarted FF. I now get the normal "untrusted" error then re-imported the private CA to make the "untrusted" error go away. However, that still gave me SEC_ERROR_BAD_SIGNATURE. So, something must've changed.

I even tried disabling OCSP checking (thought it was optional if it couldn't check). I then disabled OCSP Stapling. Neither resolved this issue, thinking it was trying to check with the OCSP server, which it can't reach due to firewall since it's internal to the other private LAN.

I'm not sure where to look. I tried Googling for answers, which lead me to the above two solutions to try.

The CA I have is a private CA, generated by Microsoft Windows Server 2008 R2 with the Active Directory Certificate Authority installation. Like I said, it was working in FF fairly recently. Let me know what else you need for me to provide.

Regards,

John Babbitt Systems Administrator Cutler Investment Group, LLC

Hi,

I have a spr532 card reader with a test smartcard with Firefox 50.1.0 on Ubuntu 16.04 up to date. I want to use the client certificate from the device to log in on a website that I am developing.

I also have a test certificate that I generated and it is not on the card. I can log in with the test certificate that I have but not with the one on the card. The problem is that in the "User identification request" page I cannot see the certificate from the smartcard. I can see my generated certificate but not the one on the smartcard. Firefox asks me for the pins for the smartcard (I have two certs on the card and they both have PINs). Firefox sees my certs from the smartcard in about:preferences#advanced > View Certificates > Your Certificates column. I have both the certs on the smartcard and the one I generated in that table. But when I try to log in, Firefox only shows me my generated cert and not the one from the smartcard.

What can I do? How can I debug this? This is a dev environment. I can change any configs on the server so I can decrypt the TLS session and see what is going on between my server and the browser.

PS: I tried to send this message with 2 other email accounts but I do not get the confirmation email.

Thank you!

Yeah, one of these topics again.

Seeing how often this gets posted making a new thread was a last resort, but I'm at my wits end here. Two days ago Firefox (actually Waterfox, but after testing Fire I seem to have the problem on both browsers) started returning a "Your connection is not secure" error on what seems to be every single https URL and I can't even add exceptions. This happened once before two weeks ago, but it fixed itself after a few hours. No idea what caused it or what fixed it. It does not affect other browsers, but strangely it does affect the Blizzard Battle.net app and does not allow it to connect to the internet (so I can't play anything).

I've spent the last two days digging through support threads trying every solution I could find. I'm not using Kaspersky (turned off all protection features in AVG and Windows just to be sure, didn't work and have since turned them back on), I've tried importing certificates from other browsers, I've reset my network settings, I've tried disabling all of my addons, I've tried changing Firefox proxy settings, I've tried a new Firefox profile, I've run system scans and registry fixes, I've tried safe mode, I've deleted Firefox's cert file, I've reset my system countless times, I've reset my router, I've even confirmed my date/time settings were correct. Nothing has worked so far. Is there anything I haven't tried?

https://www.google.com/

Peer’s Certificate issuer is not recognized.

HTTP Strict Transport Security: false HTTP Public Key Pinning: true

Certificate chain:

MIIC4zCCAcugAwIBAgIRAKm8ETiNySk9HA4+VJnjuUMwDQYJKoZIhvcNAQELBQAw KjELMAkGA1UEBhMCRU4xGzAZBgNVBAMMEjE5MGM4MmMxOWFiNDZhNDAgMjAeFw0x NzA4MTUxNjA0MDBaFw0xNzExMDcxNjA0MDBaMGgxCzAJBgNVBAYTAlVTMRMwEQYD VQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1Nb3VudGFpbiBWaWV3MRMwEQYDVQQK DApHb29nbGUgSW5jMRcwFQYDVQQDDA53d3cuZ29vZ2xlLmNvbTCBnzANBgkqhkiG 9w0BAQEFAAOBjQAwgYkCgYEAwWhyT4acv2vC2P8a57MRH0LyAD1zltYPzHFQtvK6 xwxwO61aLb8itMXQQSx8aW4nH3F1ab0UquNrgyDD4IZtR9U2Vm4CoCVUuhzZRvqI Rzb3UrCVasYgCirBnK4NevDKe2rfT4XUL6eFmy8L6Oklx9qjL/5n4qTnCWtW10Wj Og0CAwEAAaNKMEgwGQYDVR0RBBIwEIIOd3d3Lmdvb2dsZS5jb20wDAYDVR0TAQH/ BAIwADAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDQYJKoZIhvcNAQEL BQADggEBAKGs/qQ5Pbb0+BL7nPF+EMFGH/6qVteQ8DcMaXJ1c7RKqdNxnel7F3oP T+bz9ma0Pf7yCrhjhVRZWJytazsbSHDVizltwdMA7+HzmNv5z113khJW7RdPKFAj 2t9RWV5PhXBGTTn5PvroVp888lPMtRtvMJS5udle3cjcFWlKsBSAoEKTH4eCra1o hbS6kmVYbWBFXaXa7RaGzLale6N/4qI/CUoJoRJAXKnoMMGhA2JwkRBrt+pI+wVq n2GYfbOA72k2N4LG/fdndZTwugSfUYbKnLnx9BDbe4twG3njNrl26acNZ4ikVEuj YGdt9h6q+ZLUfhwXk6e7YsAEtkXr4So=

https://www.mozilla.org/

Peer’s Certificate issuer is not recognized.

HTTP Strict Transport Security: false HTTP Public Key Pinning: false

Certificate chain:

MIIDjTCCAnWgAwIBAgIRAMqhxAyYotgVaDQJGzzOpBUwDQYJKoZIhvcNAQELBQAw KjELMAkGA1UEBhMCRU4xGzAZBgNVBAMMEjE5MGM4MmMxOWFiNDZhNDAgMjAeFw0x NjExMDkwMDAwMDBaFw0xODExMTQxMjAwMDBaMIIBAjEdMBsGA1UEDwwUUHJpdmF0 ZSBPcmdhbml6YXRpb24xEzARBgsrBgEEAYI3PAIBAxMCVVMxGzAZBgsrBgEEAYI3 PAIBAhMKQ2FsaWZvcm5pYTERMA8GA1UEBRMIQzI3NTkyMDgxHjAcBgNVBAkTFTY1 MCBDYXN0cm8gU3QgU3RlIDMwMDEOMAwGA1UEERMFOTQwNDExCzAJBgNVBAYTAlVT MRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1Nb3VudGFpbiBWaWV3MRww GgYDVQQKExNNb3ppbGxhIENvcnBvcmF0aW9uMRQwEgYDVQQDEwttb3ppbGxhLm9y ZzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA1+ZJvmO2xcMjNDoz/BT5jOuc 53HsRHhw1kNlE3MzHWvCQTKjaBW0uvm5P8ge6NnU1YdEvNXLZRLnVTClz5ZxdNMA /G9CTw2Y665My/BLVqrUWVhWg0oC4txGIGWFM36OdSnFOsTZ2GWkdoG3RKT/qRO8 EukAHjRWF/j5ZZgn8YUCAwEAAaNYMFYwJwYDVR0RBCAwHoILbW96aWxsYS5vcmeC D3d3dy5tb3ppbGxhLm9yZzAMBgNVHRMBAf8EAjAAMB0GA1UdJQQWMBQGCCsGAQUF BwMBBggrBgEFBQcDAjANBgkqhkiG9w0BAQsFAAOCAQEAyu7s3kwFqIHFWTTN9sVv c1RHaKCCi000M9n8fxuAg8s3QumPEpuW28vT0Qa1/yIG2zKhGlM5pQeqSuFoaT0d vUXm6ypXXvLpLe7vDEfmrgyzo+nH4sNk+rdp2sujOCwLwgPYUI+BtQA3ldeH7FR9 XzTnVJaveWzZ5N9OqFYkfvL0Kbl34HH6F6esMD22zXrfEtP/aKYnLDhIkcN3d1Wz vbl6RPlC2ObM/dOiiVXYdmjUIGTJbQt2486klYHXse4mpDFlj8UVafFOJwfMEBNm QPWzJZwR2UrGTKRKgM1G+m3gV4dN9GSBAwTXfatey/xI+LzyZo7luPuyLe2J07LO bw==

https://tweetdeck.twitter.com/

Peer’s Certificate issuer is not recognized.

HTTP Strict Transport Security: true HTTP Public Key Pinning: true

Certificate chain:

MIIDpTCCAo2gAwIBAgIRAJ3Y95mfyPRGAhjp4VURxgkwDQYJKoZIhvcNAQELBQAw KjELMAkGA1UEBhMCRU4xGzAZBgNVBAMMEjE5MGM4MmMxOWFiNDZhNDAgMjAeFw0x NTA1MjAwMDAwMDBaFw0xODA1MjQxMjAwMDBaMIGFMQswCQYDVQQGEwJVUzELMAkG A1UECBMCQ0ExFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xFjAUBgNVBAoTDVR3aXR0 ZXIsIEluYy4xGTAXBgNVBAsTEFR3aXR0ZXIgU2VjdXJpdHkxHjAcBgNVBAMTFXR3 ZWV0ZGVjay50d2l0dGVyLmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA yviGfBEk5QwMrKWRjeT4/bkUg+nwRXj2WhyIMEujDnVLTLG8raY9gyygyvFcpo9z i6t6+BncW+2bIhQde5PMnSLkFyk3qdOLlX5ZZVxsZCB10XndYGbCkOAyLw2/13I+ jOEB6YFxhnrUGx2RhvgrmMCzuTk7FvbRzAiJrmf12GMCAwEAAaOB7TCB6jCBugYD VR0RBIGyMIGvghV0d2VldGRlY2sudHdpdHRlci5jb22CDXR3ZWV0ZGVjay5jb22C EXd3dy50d2VldGRlY2suY29tghF3ZWIudHdlZXRkZWNrLmNvbYIRYXBpLnR3ZWV0 ZGVjay5jb22CF2Rvd25sb2Fkcy50d2VldGRlY2suY29tghF0ZGFwaS50d2l0dGVy LmNvbYIOdGQudHdpdHRlci5jb22CEmJsb2cudHdlZXRkZWNrLmNvbTAMBgNVHRMB Af8EAjAAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjANBgkqhkiG9w0B AQsFAAOCAQEAJBZPSGGy1MVwJAQmYkX/nCkkbhHMxNI0c9Hf20PnPaHErEPQwbVJ obdeGaT06BfXKBqyIwn0wgGWPlyQkc6JI4Tilb/Sw1k74W3gl8ips6yCbaoouVFC T9XwL1cB25TedHzqCMBzr7JpLaT3HxFmE8SNJpel8/HuZwDygl3bmcxvkcTophiE qgDBcTAlvukgQOWlF5ihBs3sdw6j9gjDc/MaediuNr2MZQk5ZmwTMS50S8F4giGd aJr9sUF5z6hOh1BaqKFGvBgsGr8u8iX7xNkCqGZR/PQikAgbnYre8gtg+ek8JcPW WGRXkpIv/9Vd6POiSW/l9fX9v/HNP63b/A==

When I log into Yahoo mail on Firefox 40.0.3 (on Windows 7) on my company-supplied laptop, I get this message: "You have asked Firefox to connect securely to us-mg5.mail.yahoo.com, but we can't confirm that your connection is secure."

I cannot create an exception: "This site uses HTTP Strict Transport Security (HSTS) to specify that Firefox only connect to it securely. As a result, it is not possible to add an exception for this certificate."

The "technical details" section states: "us-mg5.mail.yahoo.com uses an invalid security certificate. The certificate is not trusted because the issuer certificate is unknown. The server might not be sending the appropriate intermediate certificates. An additional root certificate may need to be imported. (Error code: sec_error_unknown_issuer)"

This does not happen at home, so the company laptop has something to do with it, but, even on the company laptop I do not have this problem when using Chrome, so it's not that the company does not allow access to outside mail.

On Firefox, the problem is intermittent. Sometimes, there is no problem and everything works fine. Clearing history/cookies/cache and restarting does not fix the problem. It sometimes goes away on its own for a little while, but then returns.

I have searched every database I could for answers, but have found no solution yet. The computer clock is correct, I'm not using Avast, etc. (some of the other situations I've run across).

I hope that I can get this resolved, because I'd rather keep using FF, which I've used for years, than switch to Chrome.

Thanks for your help, in advance.

In my work computer, Firefox always gives "sec_error_unknown_issuer" error and only on HTTPS sites.

I have browsed the forums and understood that this is most probably caused by a sofware that performs HTTPS scanning. (See [this](https://support.mozilla.org/en-US/questions/1030927) and [this](https://support.mozilla.org/en-US/questions/1026631#answer-650916) answer)

However, I really don't know which software is performing the HTTPS scanning exactly.

Is there a way that I can determine which software is doing the HTTPS scanning so that I will be able to add its certificate to Firefox and hence be able to use the Firefox properly?

Thank you very much in advance

Regards

Hi, i have problem with ca comodo certificate. I bought the ssl wildcard certificate in COMODO, it's fine work in all browsers except some versions of firefox. I game developer, create game, it's game load xml from url https://fwassets.voltapps.ru/assetsSources/lobby/lobbyDescription.xml

and show security error (image attached). In error

wassets.voltapps.ru использует недействительный сертификат безопасности. К сертификату нет доверия, так как отсутствует цепочка сертификатов издателя. (Код ошибки: sec_error_unknown_issuer) {text in russian}

Exception reason is undefined ca comodo certificate. Undefined certificate you can see here http://fwassets.voltapps.ru/comododomain.cer .

Technical details: Mac os x yosemite firefox 35.0

Sorry for my english. Thanks for help

this used to be on the advanced tab of the options menu, but is no longer there and I can not find it anywhere. Anyone know where this was moved to?

I have an exception I would like to remove.

Secure Connection Failed

An error occurred during a connection to gmail.com. SSL received a record that exceeded the maximum permissible length. Error code: SSL_ERROR_RX_RECORD_TOO_LONG

   The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
   Please contact the website owners to inform them of this problem.