1745600 - MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING on some Microsoft sites

Status: VERIFIED FIXED

(Web Compatibility :: Site Reports, defect)

Description

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0

Steps to reproduce:

All I have to do is try to go to...
https://docs.microsoft.com/en-us/windows-hardware/design/minimum/supported/windows-11-supported-amd-processors

Actual results:

Firefox 95.0 will generate this error, even with... UNchecked in settings.
"Query OCSP responder servers to confirm the current validity of certificates"

https://i.imgur.com/0pUu2hD.png

Expected results:

It should have opened the site!!

Comment 1

[Ghot]

It's bad enough that Firefox balks at downloading from Microsoft Update Catalog, but at least I can "allow" that.
But this "can't even open the site" BUG is just plain ridiculous.

Comment 2

[Ghot]

Attachment: About:support summary

Comment 3

[Ghot]

Attachment: About:Support summary2

I just restored from a backup that's running Firefox 93.0, and everything works fine.

Comment 4

[Ghot]

Well, I had uninstalled EDGE. So I figured I'd reinstall it and try that link again.
Reinstalled, rebooted, and poof... the link works again.

Seems that Microsoft doesn't LIKE people uninstalling Edge. :/

Comment 5

[Ghot]

I just reinstalled EDGE on Win 10 and Win 11. Win 10 is on FF 93.0, and Win 11 is on FF 95.0
On Win 10 I can open the link. I still can't open it on Win 11, even with EDGE reinstalled.

Comment 6

[Ghot]

Maybe Microsoft is going to punish me for a longer period of time on Windows 11. :)

Comment 7

[Ghot]

...and that Microsoft "doc" link just failed again. The Is on Windows 10, with EDGE installed, running Firefox 93.0

This is the link in question...
https://docs.microsoft.com/en-us/windows-hardware/design/minimum/supported/windows-11-supported-amd-processors

Fails on the link for compatible Intel processors too.
https://docs.microsoft.com/en-us/windows-hardware/design/minimum/supported/windows-11-supported-intel-processors

Secure Connection Failed

An error occurred during a connection to docs.microsoft.com. The OCSP response does not include a status for the certificate being verified.

Error code: MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING

The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
Please contact the website owners to inform them of this problem.

Comment 8

[Ghot]

Those links work on EDGE... no problem.

Comment 9

[Ghot]

Attachment: About:support FF93.0 with EDGE installed

In case it helps...

Comment 10

[Ghot]

Attachment: About:support Win 11, FF95.0 EDGE removed

The "docs" link works on Win 11, FF 95.0 with EDGE uninstalled.  
To get it to work, I had to enable this option in Bitdefender Internet Security...

https://imgur.com/yqwbCSs

Comment 11

[Ghot]

Attachment: Win 11, FF 95.0 with EDGE removed

The "docs" link works on Win 11, FF 95.0 with EDGE uninstalled.  
To get it to work, I had to enable this option in Bitdefender Internet Security...

https://imgur.com/yqwbCSs

Comment 12

[Ghot]

Attachment: About:support Win 10, FF 95.0, EDGE removed

Comment 13

[OK]

I can confirm this problem on https://forms.office.com where multiple scripts from https://cdn.forms.office.net/forms/scripts/* gives error MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
Other Microsoft URLs are working for me.

Comment 14

[Brian Lalonde]

I'm getting this on https://msdn.microsoft.com/

Mozilla Observatory doesn't seem particularly impressed with their configuration https://observatory.mozilla.org/analyze/msdn.microsoft.com#tls

Comment 15

[jpaul_johnson]

Having same issue trying to access https://support.microsoft.com/help/4468253#managehello. I'm using FF 95 64-bit.

Comment 16

[Gingerbread Man]

Is everyone else chiming in here also using Bitdefender security software, like the reporter?

Comment 17

[OK]

(In reply to Gingerbread Man from comment #16)

Is everyone else chiming in here also using Bitdefender security software, like the reporter?

No bitdefender on my computer. I do have comodo firewall, but the problem exists even if I disable it.

Comment 18

[Brian Lalonde]

No Bitdefender hello I, and I'm getting this in both Windows Firefox and Android Firefox.

Comment 19

[Brian Lalonde]

s/hello I/here/

Comment 20

[Ghot]

One of the modules in Bitdefender Internet Security is: Online Threat Prevention.
One of the toggles in there is this...

https://imgur.com/MiXJaEd

When I disable it, I have the problem. I don't think this is related to other's issues.
It's almost like, when disabled it assumes ALL iffy certs are bad, and then blocks them.

Since re-enabling this, I haven't had this problem. But there IS something going on, because I know others
without 3rd party antivirus are experiencing this issue intermittently.

Comment 21

[kbsauer1]

I'm getting this on Firefox 95.0 on Arch Linux on www.microsoft.com microsoft.com and msdn.microsoft.com.

Comment 22

[Pulse]

Attachment: ssl.txt

Comment 23

[Pulse]

I'm seeing this only on support.microsoft.com all other MS properties I tried seem to be working correctly. I noticed that if I set security.ssl.enable_ocsp_stapling to false I can access the site.

I also ran and openssl check.

Comment 24

[Pulse]

I should also have mentioned that changing the pref is not a good solution. I was just testing.

Comment 25

[Pulse]

Three's also a bug thread for this open at Microsoft.

Comment 26

[Gingerbread Man]

The aforementioned sites work for me. Confiming this due to the multiple reports. Setting NI flag for :keeler to draw some attention.

Update: I'm now getting the error on https://account.microsoft.com

Comment 28

[Selim Şumlu]

I can reproduce this on https://answers.microsoft.com/
I'm using Windows 11, latest Nightly, no security software installed. (Windows Defender is enabled.)

Comment 30

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Bug 966856 should take care of this.

Comment 31

[paisleyborg]

Also not able to open ANY Microsoft documentation on https://docs.microsoft.com/*
(Windows 10, Firefox 95, x64)

Comment 32

[paisleyborg]

or anything on https://go.microsoft.com/fwlink*

Comment 34

[mlathoud]

Ditto there with most sites MS, i.e https://statics.teams.cdn.office.net/evergreen-assets/safelinks/1/atp-safelinks.html
It eventually works after a bunch of retries/waiting.

Comment 35

[Dennis Schubert [:denschub]]

Hey everyone -- it looks like the cause is known by now, and a fix for this issue is actively being worked on in bug 966856. Let's all be patient until this work is done. :)

I'll move this bug into the Web Compatibility component for now, since the aforementioned bug is already in the right component and is being tracked by the right people. There is no need to have multiple issues open in their product, so let's move this to WebCompat.

Comment 36

[Kelimutu [:kiki]]

This happens to me too when I was trying to access Microsoft Partner site.

This forum thread (https://docs.microsoft.com/en-us/answers/idea/660411/problem-with-secure-connection.html) suggests that the problem can be resolved by turning off DNS over HTTPS, but it didn't work when I tried it.

Comment 37

[Kelimutu [:kiki]]

Related SUMO discussion: https://support.mozilla.org/en-US/forums/contributors/715454?last=82537#post-82537

Comment 38

[Dennis Schubert [:denschub]]

Note that this is not fixed, we're still actively working on getting fixes rolled out. However, the issue appears to be somewhat intermittent, so sometimes it will just work, sometimes it won't. This issue will be updated/closed when the work is done. :)

Comment 40

[Intrepid]

The entire Microsft.com domain is blocked, not just "some Microsoft sites".

Comment 41

[Intrepid]

So, we have Firefox that won't open https://www.microsoft.com for over 4 days now...?

Comment 42

[Ryan VanderMeulen [:RyanVM]]

We expect to ship Firefox 95.0.1, 96.0b6, and 91.4.1esr releases tomorrow which will resolve this bug. New Nightly builds with the fix are also running now and should be available within a few hours.

Comment 43

[Delia Pop (Android QA)]

Verified as fixed on Android Firefox 95.2.0 (Build 2015851755) RC build with LG G7 fit (Android 8.1.0) and Samsung Galaxy Tab S3 (Android 9). We have checked all the websites mentioned in the comments, they load as expected and no error was displayed.

Comment 44

[Ciprian Georgiu, Desktop QA]

This was also verified as fixed on desktop, using Firefox 95.0.1 and 91.4.1esr, on the mentioned websites from this bug report, and other duplicates. The OS's tested, alongside with the entire site list can seen here.

Initially, we've reproduced the bug on Win 11 and macOS, with an affected Nightly build (97.0a1, 2021-12-11)

Comment 46

[Gingerbread Man]

I see no reason to reopen this without justification, especially after it's already been verified by QA.

Comment 47

[ben]

Verified as fixed on Windows 10.0.19044 N/A Build 19044

Comment 48

[Parrey]

I have tested this on android and desktop both working correctly after updated.
The Firefox Developer Edition still fails when access microsoft websites. Is there an updated build / update for this.
Currently says 96.0b5 (64-bit)

Comment 49

[Peter Saint-Andre [:stpeter]]

This fix will be in the beta6 build, which is still slated for release today, December 16.

Comment 50

[Alexandru Trif, Desktop Test Engineering [:atrif]]

We have also performed a verification with 96.0b6 (20211216190150) and no issues were encountered. More details here.