We're calling on all EU-based Mozillians with iOS or iPadOS devices to help us monitor Apple’s new browser choice screens. Join the effort to hold Big Tech to account!

Avatar for Username

ძიება მხარდაჭერაში

ნუ გაებმებით თაღლითების მახეში მხარდაჭერის საიტზე. აქ არასდროს მოგთხოვენ სატელეფონო ნომერზე დარეკვას, შეტყობინების გამოგზავნას ან პირადი მონაცემების გაზიარებას. გთხოვთ, გვაცნობოთ რამე საეჭვოს შემჩნევისას „დარღვევაზე მოხსენების“ მეშვეობით.

ვრცლად

ეს თემა დაარქივებულია. დასვით ახალი კითხვა, თუ დახმარება გესაჭიროებათ.

SEC_ERROR_BAD_SIGNATURE returned on private PKI containing intermediate CA

  • 2 პასუხი
  • 1 მომხმარებელი წააწყდა მსგავს სიძნელეს
  • 1 ნახვა
  • ბოლოს გამოეხმაურა cosmin.banu

cosmin.banu
cosmin.banu
more options

I am trying to browse websites through a proxy that intercepts the TLS connections and signs the certificates using a private CA certificate.

If I'm using only a root CA certificate, setting it on my proxy as well as in the OS's certificates store, I can browse the internet without any issues. The chains in this case would be: Root CA -> Server Certificates

However, my setup mandates that I use an intermediate CA on the proxy. The chains in this case would be: Root CA -> Intermediate CA -> Server Certificates If I add an intermediate CA to the proxy and the root CA to my OS's certificates store, I get the following error:

" Secure Connection Failed An error occurred during a connection to www.youtube.com. Peer’s certificate has an invalid signature. Error code: SEC_ERROR_BAD_SIGNATURE 

   The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
   Please contact the website owners to inform them of this problem.

"

I'm using Firefox 82.0.2 on Windows 10.

How can I get more details on why it's failing? I've tried looking in the "Security" tools tab, but I see only this error ID.

Thank you, Cosmin

I am trying to browse websites through a proxy that intercepts the TLS connections and signs the certificates using a private CA certificate. If I'm using only a root CA certificate, setting it on my proxy as well as in the OS's certificates store, I can browse the internet without any issues. The chains in this case would be: Root CA -> Server Certificates However, my setup mandates that I use an intermediate CA on the proxy. The chains in this case would be: Root CA -> Intermediate CA -> Server Certificates If I add an intermediate CA to the proxy and the root CA to my OS's certificates store, I get the following error: " Secure Connection Failed An error occurred during a connection to www.youtube.com. Peer’s certificate has an invalid signature. Error code: SEC_ERROR_BAD_SIGNATURE The page you are trying to view cannot be shown because the authenticity of the received data could not be verified. Please contact the website owners to inform them of this problem. " I'm using Firefox 82.0.2 on Windows 10. How can I get more details on why it's failing? I've tried looking in the "Security" tools tab, but I see only this error ID. Thank you, Cosmin

გადაწყვეტა შერჩეულია

I've found the root cause. The chain was incorrectly constructed, there was a mismatch between the server certificate's issuer field and the subject of the CA certificate.

პასუხის ნახვა სრულად 👍 0

ყველა პასუხი (2)

cosmin.banu
cosmin.banu კითხვის დამსმელი
more options

Update:

I've reproduced this on two setups now on Windows 10, in different PKI configurations (both using an intermediate CA), using: - Firefox 82 - Firefox nightly 65 - Firefox nightly 84

On Linux (Debian 10) it works, using: - Firefox ESR 78.4

I've tested some other browsers on Windows 10, as well, they all work fine: - Chrome - Opera - Vivaldi - Edge

Is there a way to get some detailed debug logs on Firefox on Windows 10?

Thank you, Cosmin

cosmin.banu
cosmin.banu კითხვის დამსმელი
more options

შერჩეული გადაწყვეტა

I've found the root cause. The chain was incorrectly constructed, there was a mismatch between the server certificate's issuer field and the subject of the CA certificate.