I get ocsd msg signing into Microsoft prod. nothing helps
I get an Error code: SEC_ERROR_OCSP_INVALID_SIGNING_CERT when I sign in to any Microsoft product (Hotmail, Bing, MSN). I tried troubleshooting articles, but nothing helped. I called Microsoft who had me clear cookies and cache since I can sign in with no problems on Internet Explorer and Chrome. That did not work. They said to call Mozilla support, but I can't find a number.
Please help.
الحل المُختار
hi, unfortunately MS has misconfigured a security feature (OCSP stapling) on their servers which got now cached in your local firefox installation.
in order to resolve that, please enter about:config into the firefox address bar (confirm the info message in case it shows up) & search for the preference named security.ssl.enable_ocsp_stapling. double-click it and change its value to false - this will degrade a security feature in firefox, so please revisit it in a couple of days again after microsoft has fixed their stuff and turn it back on again then...
Read this answer in context 👍 1All Replies (6)
الحل المُختار
hi, unfortunately MS has misconfigured a security feature (OCSP stapling) on their servers which got now cached in your local firefox installation.
in order to resolve that, please enter about:config into the firefox address bar (confirm the info message in case it shows up) & search for the preference named security.ssl.enable_ocsp_stapling. double-click it and change its value to false - this will degrade a security feature in firefox, so please revisit it in a couple of days again after microsoft has fixed their stuff and turn it back on again then...
philipp,
I put the about:config into the address and get a message that tells me it might void my warranty and wants me to click a box that says I accept the risk. Is this what Is supposed to be on that page?
yes (and it's more of a joke - firefox is a free product and doesn't have a warranty). after you've clicked on that you'll get to a list of preferences...
YAY!!! Thank you SO much philipp. It worked! What happens if I just leave it on false rather than changing it back?
on a high level it might slow down the loading time of secure sites a bit and have a privacy impact.
in more detail: OCSP is a mechanism to check that a certificate used by https sites was not revoked and should still be trusted (this needs to be done to quickly disable certs that are "stolen" so that attackers cannot impersonate trustworthy sites) - this can be done either by asking the certificate authority that has issued the particular certificate each time before you visit a site (which would be slow and kind of allows them to recognize which user navigates to which sites) or the second option is "ocsp stapling" where the server you're trying to reach is basically providing a short-lived assurance from the certificate's issuer that the cert is still considered valid. the latter is the option we asked you to temporarily disable, since microsoft is currently sending an expired ocsp stapling response on some of it's servers which is causing all this hassle...
ok, thank you!