Avatar for Username

Sykje yn Support

Mij stipescams. Wy sille jo nea freegje in telefoannûmer te beljen, der in sms nei ta te stjoeren of persoanlike gegevens te dielen. Meld fertochte aktiviteit mei de opsje ‘Misbrûk melde’.

Mear ynfo

Dizze konversaasje is argivearre. Stel in nije fraach as jo help nedich hawwe.

We operate in a very restricted DNS environment and downloading sites with signed wildcard SSL is very slow so how do we disable all checks and keep HTTPS?

  • 2 antwurd
  • 3 hawwe dit probleem
  • 1 werjefte
  • Lêste antwurd fan ELCV

ELCV
ELCV
more options

If we were using a self-signed certificate we could add an exception. But we use a DigiCert wildcard certificate. Our sites use a very restricted DNS with maybe a dozen URLs for which a name resolves to an IP. When Firefox is used to access our sites over HTTPS it is slow and often fails to load bu serving up error messages on the security of the site. I believe this is because it is looking to verify the certificate or revocation. We do not have this issue using HTTP. I have disabled "Query OCSP" but it has not helped.

Any assistance would be appreciated.

Thanks.

If we were using a self-signed certificate we could add an exception. But we use a DigiCert wildcard certificate. Our sites use a very restricted DNS with maybe a dozen URLs for which a name resolves to an IP. When Firefox is used to access our sites over HTTPS it is slow and often fails to load bu serving up error messages on the security of the site. I believe this is because it is looking to verify the certificate or revocation. We do not have this issue using HTTP. I have disabled "Query OCSP" but it has not helped. Any assistance would be appreciated. Thanks.

Keazen oplossing

So, I have a solution for this, but I don't consider it ideal.

Our certificate provider uses two URLs resolving to a single IP to validate certificates. Adding these records to our restricted DNS solves the problem. However, IPs addresses do change from time-to-time and each site would have to be updated should that happen.

Ideally, it would be nice if Mozilla would add a "trust" or whitelist option to Firefox.

Thanks.

Dit antwurd yn kontekst lêze 👍 0

Alle antwurden (2)

FredMcD
FredMcD
more options

I've called the big guys to help you. Good luck.

ELCV
ELCV Fraacheigener
more options

Keazen oplossing

So, I have a solution for this, but I don't consider it ideal.

Our certificate provider uses two URLs resolving to a single IP to validate certificates. Adding these records to our restricted DNS solves the problem. However, IPs addresses do change from time-to-time and each site would have to be updated should that happen.

Ideally, it would be nice if Mozilla would add a "trust" or whitelist option to Firefox.

Thanks.