5 ms·

Sorry for the OT, but I always get a certificate error when visiting that domain. Am I the only one? http://www.sslshopper.com/ssl-checker.html#hostname=hacks.

Sorry for the OT, but I always get a certificate error when visiting that domain. Am I the only one? http://www.sslshopper.com/ssl-checker.html#hostname=hacks.mozilla.org http://www.sslshopper.com/ssl-checker.html#hostname=hacks.mo... Says the cert is ok, but my firefox complains: hacks.mozilla.org uses an invalid security certificate. The certificate is only valid for tbpl.mozilla.org (Error code: ssl_error_bad_cert_domain) Maybe there is something wrong with my network.

dbaupp 14y ago
It's fine for me.
JimmaDaRustla 14y ago
Update your browser - happens to me in IE8, but not Chrome 22. Certification verification is done by the browser, and I believe they store acceptable CA signers somehow, which is probably out dated. Edit: Don't quote me, been a while since studying site certificates.
- y0ghur7_xxx 14y ago
  I have the latest ff: 16.0.2. I even tried $ openssl s_client -connect hacks.mozilla.org:443 from a linode vm: CONNECTED(00000003) --- Certificate chain 0 s:/serialNumber=I1oZ-yurbFWiPu/xP8HIzW3f9mApQvMv/C=US/ST=California/L=Mountain View/O=Mozilla Corporation/OU=IT/CN=tbpl.mozilla.org i:/C=US/O=GeoTrust, Inc./CN=GeoTrust SSL CA 1 s:/C=US/O=GeoTrust, Inc./CN=GeoTrust SSL CA i:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA 2 s:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA i:/C=US/O=Equifax/OU=Equifax Secure Certificate Authority --- Server certificate [...] subject=/serialNumber=I1oZ-yurbFWiPu/xP8HIzW3f9mApQvMv/C=US/ST=California/L=Mountain View/O=Mozilla Corporation/OU=IT/CN=tbpl.mozilla.org issuer=/C=US/O=GeoTrust, Inc./CN=GeoTrust SSL CA Any idea?
  - superawesome 14y ago
    s_client doesn't support SNI, so this is expected behavior. The client (s_client) doesn't know how to tell the server what hostname it's requesting during the handshake... so the server returns the default one. After the handshake completes, normal HTTP semantics kick in and the client/server have no problems... but by then it's too late, and the client has already negotiated based on the wrong cert.
- positivelogic 14y ago
  This advisory seems to clear up Internet Explorer's reluctance: http://support.microsoft.com/kb/2643584 http://support.microsoft.com/kb/2643584
- superawesome 14y ago
  Wild guess... are you on WinXP? WinXP + any version of IE does not support TLS SNI... even though it does support TLSv1.0, it doesn't support the SNI extension. Supported in Vista and 7, though. Chrome, Firefox, and Opera (on any platform) all support TLSv1.0, with or without SNI.
mlok 14y ago
Same error for me (using latest FF on Ubuntu)
- superawesome 14y ago
  Do you have TLSv1.0 disabled (see briansmith's comment)?
briansmith 14y ago
You may have TLS 1.0 disabled (Tools > Options > Advanced > Encryption > TLS 1.0). Make sure both of those checkboxes (SSL 3.0 and TLS 1.0) are checked.
- y0ghur7_xxx 14y ago
  That was it. Thank you.
anonymous 14y ago
Could that be because of some "transparent" proxy server your ISP uses? Works for me, btw.
superawesome 14y ago
I see you commented on a fix already, but here's some background... This is due to TLS SNI, which allows different certs to be returned based on the hostname requested. SNI is supported by all major browsers on all major platforms, with 1 significant exception: WinXP+IE does not support SNI (WinXP+Firefox/Opera/Chrome are all fine for many versions, WinVista/7+IE are both fine). I think certain (older) Android platforms have a problem with this too. SNI is really awesome because the web hosting company doesn't have to allocate separate IP addresses for multiple sites to have proper SSL support. It makes HTTPS hosting simpler and cheaper. The only significant downside is issues like this, where a user's browser doesn't support it... hence over time, issues like this should shrink. If you're still on WinXP+IE, you're likely to start running into more and more problems in the next couple years (and not just due to SNI).

dbaupp 14y ago

It's fine for me.

JimmaDaRustla 14y ago

Update your browser - happens to me in IE8, but not Chrome 22. Certification verification is done by the browser, and I believe they store acceptable CA signers somehow, which is probably out dated. Edit: Don't quote me, been a while since studying site certificates.

y0ghur7_xxx 14y ago
I have the latest ff: 16.0.2. I even tried $ openssl s_client -connect hacks.mozilla.org:443 from a linode vm: CONNECTED(00000003) --- Certificate chain 0 s:/serialNumber=I1oZ-yurbFWiPu/xP8HIzW3f9mApQvMv/C=US/ST=California/L=Mountain View/O=Mozilla Corporation/OU=IT/CN=tbpl.mozilla.org i:/C=US/O=GeoTrust, Inc./CN=GeoTrust SSL CA 1 s:/C=US/O=GeoTrust, Inc./CN=GeoTrust SSL CA i:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA 2 s:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA i:/C=US/O=Equifax/OU=Equifax Secure Certificate Authority --- Server certificate [...] subject=/serialNumber=I1oZ-yurbFWiPu/xP8HIzW3f9mApQvMv/C=US/ST=California/L=Mountain View/O=Mozilla Corporation/OU=IT/CN=tbpl.mozilla.org issuer=/C=US/O=GeoTrust, Inc./CN=GeoTrust SSL CA Any idea?
- superawesome 14y ago
  s_client doesn't support SNI, so this is expected behavior. The client (s_client) doesn't know how to tell the server what hostname it's requesting during the handshake... so the server returns the default one. After the handshake completes, normal HTTP semantics kick in and the client/server have no problems... but by then it's too late, and the client has already negotiated based on the wrong cert.
positivelogic 14y ago
This advisory seems to clear up Internet Explorer's reluctance: http://support.microsoft.com/kb/2643584 http://support.microsoft.com/kb/2643584
superawesome 14y ago
Wild guess... are you on WinXP? WinXP + any version of IE does not support TLS SNI... even though it does support TLSv1.0, it doesn't support the SNI extension. Supported in Vista and 7, though. Chrome, Firefox, and Opera (on any platform) all support TLSv1.0, with or without SNI.

mlok 14y ago

Same error for me (using latest FF on Ubuntu)

superawesome 14y ago
Do you have TLSv1.0 disabled (see briansmith's comment)?

briansmith 14y ago

You may have TLS 1.0 disabled (Tools > Options > Advanced > Encryption > TLS 1.0). Make sure both of those checkboxes (SSL 3.0 and TLS 1.0) are checked.

y0ghur7_xxx 14y ago
That was it. Thank you.

anonymous 14y ago

Could that be because of some "transparent" proxy server your ISP uses? Works for me, btw.

superawesome 14y ago

I see you commented on a fix already, but here's some background... This is due to TLS SNI, which allows different certs to be returned based on the hostname requested. SNI is supported by all major browsers on all major platforms, with 1 significant exception: WinXP+IE does not support SNI (WinXP+Firefox/Opera/Chrome are all fine for many versions, WinVista/7+IE are both fine). I think certain (older) Android platforms have a problem with this too. SNI is really awesome because the web hosting company doesn't have to allocate separate IP addresses for multiple sites to have proper SSL support. It makes HTTPS hosting simpler and cheaper. The only significant downside is issues like this, where a user's browser doesn't support it... hence over time, issues like this should shrink. If you're still on WinXP+IE, you're likely to start running into more and more problems in the next couple years (and not just due to SNI).