[Solved] SEC_ERROR_UNKNOWN_ISSUER with Firefox

[Mr.Dandy]

Hello,

With Firefox x64 77.0 and Win10 x64 Pro
When access to this forum, I got an error code: SEC_ERROR_UNKNOWN_ISSUER

If I override, it displays:

Code: Select all

https://forum.openoffice.org/
The certificate is not trusted because the issuer certificate is unknown. 

HTTP Strict Transport Security : false
HTTP Public Key Pinning : false

[RoryOF]

The certificate may have expired - I have received similar notices for other applications caused by expiry of certs at end of May, issued by my O.S. security. Knowing the sites I instructed that it was safe to proceed.

[Bill]

Firefox 77 was released yesterday (June 2, 2020), so it may be a problem with the Firefox update. My Firefox 76 shows that the certificate expires July 18, 2020.

Secure website certificate

[Bill]

I just received the Firefox 77.0.1 update from Kubuntu and I still don't get this error. Firefox 77.0.1 is bug fix that was released one day after Firefox 77.0, but I don't know if the bug fix has anything to do with the error.

[RoryOF]

I have just tried the Firefox 77.0.1 upgrade (I normally use Opera) from Xubuntu 20.04, and I don't get any certificate error. Possibly the certificate has been upgraded and the upgrade notification had not reached MR Dandy's computer at the time of his posting, but was fixed in a subsequent Win 10 update.

[Mr.Dandy]

I have just tried the Firefox 77.0.1 upgrade

Seems to be fixed with this version.



Thanks folks, solved!

[Bidouille]

For me this is not fixed with Firefox x64 77.0.1
I got the same error with a new profile.
Comodo certificate seems to be a problem.

[John_Ha]

It depends on which site page you attempt to open.

If I go to the Board Index at index.php everything is OK.

If I go to this thread I get an error message.

If I check when writing this reply everything is OK.

It strongly suggests it is something on the thread page like a user image. It could be Bidouille's signature web link forum.openoffice.org/fr/ which is an insecure http:// link and not a secure https:// link.

[Bidouille]

I've got this error with the URL root: https://forum.openoffice.org
Clearly, COMODO certificate is a problem for FF.

Are you sure to start with a fresh profile?
Rename in your %APPDATA% the Mozilla directory into Mozilla.old and run Firefox.

[Bill]

I didn't see the error when I installed Kubuntu 20.04 in April, but now I do see the error when I boot from the usb stick that was used to install Kubuntu. The problem may be connected to the name change of Comodo to Sectigo last year. The Apache.org sites show Sectigo as the issuer and do not have this error.

[Bidouille]

I didn't see the error when I installed Kubuntu 20.04 in April

Yes but which browser is used?

Problem occurs only with FF and derivatives (SeaMonkey or Tor Browser)

[Bill]

I've only seen the error when using Firefox on Kubuntu 20.04 Live and Firefox or Pale Moon on PCLinuxOS Live.

[Bill]

I reproduced the problem in my installed (not Live) Kubuntu 20.04 by renaming the .mozilla directory in my home directory and uploaded a screenshot of the *openoffice.org Certificate. Note that at the top of the page, it shows the intermediate Certificate as Sectigo RSA Domain Validation Secure Server CA, but the Issuer Common Name is COMODO RSA Domain Validation Secure CA. I believe this mismatch is why Firefox rejects the certificate. On https://apache.org (which does not get the error), both are shown as Sectigo RSA Domain Validation Secure Server CA.

[Bill]

This problem now seems to be fixed. The certificate issued by COMODO expired last week. The new certificate issued by Sectigo does not produce the error.