Avatar for Username

Támogatás keresése

Kerülje el a támogatási csalásokat. Sosem kérjük arra, hogy hívjon fel egy telefonszámot vagy osszon meg személyes információkat. Jelentse a gyanús tevékenységeket a „Visszaélés bejelentése” lehetőséggel.

További tudnivalók

A témacsoportot lezárták és archiválták. Tegyen fel új kérdést, ha segítségre van szüksége.

Firefox refuses connection to my own server because of cert pinning

  • 3 válasz
  • 4 embernek van ilyen problémája
  • 3 megtekintés
  • Utolsó üzenet ettől: cor-el

Tortugueta
Tortugueta
more options

I am running a web server. In order to make use of ssl, I created my own certificate authority and issued a certificate for my website. I installed the root certificate of my authority in Firefox and trusted it to identify websites. This used to work perfectly, but now I get the following error:

An error occurred during a connection to dark.gollum.cat. security library: improperly formatted DER-encoded message. (Error code: sec_error_bad_der)

A bit of research indicates that this is related to certificate pinning. While I understand that certificate pinning is a good thing, how can I do to visit my website with Firefox? I miss a way to add an exception of some sort. How do I tell Firefox that I KNOW the certificate I'm receiving is trusted because I created the certificate myself?

For instance, Chrome does give me an error too (by the way, significantly more descriptive and useful than the one Firefox gives), but allows me to bypass it and visit the website anyway.

Thanks for the help.

I am running a web server. In order to make use of ssl, I created my own certificate authority and issued a certificate for my website. I installed the root certificate of my authority in Firefox and trusted it to identify websites. This used to work perfectly, but now I get the following error: An error occurred during a connection to dark.gollum.cat. security library: improperly formatted DER-encoded message. (Error code: sec_error_bad_der) A bit of research indicates that this is related to certificate pinning. While I understand that certificate pinning is a good thing, how can I do to visit my website with Firefox? I miss a way to add an exception of some sort. How do I tell Firefox that I KNOW the certificate I'm receiving is trusted because I created the certificate myself? For instance, Chrome does give me an error too (by the way, significantly more descriptive and useful than the one Firefox gives), but allows me to bypass it and visit the website anyway. Thanks for the help.

Összes válasz (3)

cor-el
cor-el
  • Moderator
  • Top 10 Contributor
more options

See: 

security.cert_pinning.enforcement_level
0. Pinning disabled
1. Allow User MITM (pinning not enforced if the trust anchor is a user inserted CA, default)
2. Strict. Pinning is always enforced.
3. Enforce test mode.
Tortugueta
Tortugueta Kérdés tulajdonosa
more options

Thanks for your reply @cor-el.

I understand that the default setting is what I need, and I have checked in about:config that my firefox is indeed at the default enforcement level of 1. What I don't see is how am I supposed to tell firefox that my CA is user inserted. I imported the CA root certificate manually into the "autorities" section of the certificate repo, but apparently firefox does not identify it as user inserted, since it is trying to enforce pinning when I visit my website.

So, how do I tell firefox that my certificate is user inserted?

Thanks again.

cor-el
cor-el
  • Moderator
  • Top 10 Contributor
more options

Best would be to ask experts, either on stackoverflow or via a news group or via IRC.

Módosította: cor-el,