6 ms·

Try comparing the packet conversation using Wireshark to see if Firefox is doing something different from Chrome.

capableweb 6y ago
Someone please correct me if I'm wrong, but I do think Firefox ships their own root certificates with their browser, while Chrome uses the system ones. It's possible fluidcruft's employer has installed new root certificates so they can analyze/inspect the traffic through their network and Chrome is happily rolling along, while Firefox does not like it because now the connection effectively has been broken.
- GekkePrutser 6y ago
  This is most likely exactly what's happening. On Windows you can choose to use the system store though. On other platforms you can only use the internal one
- fluidcruft 6y ago
  I 'm pretty confident that shows up as a certificate error with it's own scare page, not connection reset. Usually on cert errors you can click through all the warnings and accept the risks to connect anyway. Connection reset is just a complete dead end. I have pondered whether there's some way for the firewall to have a whitelist of sites that it allows without SSL MITM and otherwise sends reset for unknown SSL sites unless the firewall's MITM certificates are used. Our IT might be paranoid enough to do that. I don't have any evidence that the firewall does any MITM other than I found it listed as a feature that can be configured on the firewall's website when I've been googling. But even then the error people complain about is bad cert not connection resets. I have tested with Chrome on systems that IT cannot have injected certificates into and they do work. I do know that I can access my home server's let's encrypt site using firefox and chrome without problems and the keys are correct. So it's not really high in my suspicion list. Anyway it looks like I need to learn how to packet sniff.
  - capableweb 6y ago
    > I 'm pretty confident Sounds like a engineers way of saying "I think it is like this, but I should double-check just in case" because who knows what the browser can show when something different happens? I don't know, I would check it at least.
    - nitrogen 6y ago
      "Connection reset by peer" usually means that either the remote host or an intermediate gateway/firewall sent a TCP RST packet, which is not used during normal connections. Wireshark should help figure this out -- it's a superpower for anyone working in dev or IT.

Someone please correct me if I'm wrong, but I do think Firefox ships their own root certificates with their browser, while Chrome uses the system ones. It's possible fluidcruft's employer has installed new root certificates so they can analyze/inspect the traffic through their network and Chrome is happily rolling along, while Firefox does not like it because now the connection effectively has been broken.

GekkePrutser 6y ago
This is most likely exactly what's happening. On Windows you can choose to use the system store though. On other platforms you can only use the internal one
fluidcruft 6y ago
I 'm pretty confident that shows up as a certificate error with it's own scare page, not connection reset. Usually on cert errors you can click through all the warnings and accept the risks to connect anyway. Connection reset is just a complete dead end. I have pondered whether there's some way for the firewall to have a whitelist of sites that it allows without SSL MITM and otherwise sends reset for unknown SSL sites unless the firewall's MITM certificates are used. Our IT might be paranoid enough to do that. I don't have any evidence that the firewall does any MITM other than I found it listed as a feature that can be configured on the firewall's website when I've been googling. But even then the error people complain about is bad cert not connection resets. I have tested with Chrome on systems that IT cannot have injected certificates into and they do work. I do know that I can access my home server's let's encrypt site using firefox and chrome without problems and the keys are correct. So it's not really high in my suspicion list. Anyway it looks like I need to learn how to packet sniff.
- capableweb 6y ago
  > I 'm pretty confident Sounds like a engineers way of saying "I think it is like this, but I should double-check just in case" because who knows what the browser can show when something different happens? I don't know, I would check it at least.
  - nitrogen 6y ago
    "Connection reset by peer" usually means that either the remote host or an intermediate gateway/firewall sent a TCP RST packet, which is not used during normal connections. Wireshark should help figure this out -- it's a superpower for anyone working in dev or IT.