SSL Certificate Exceptions are not kept
Categories
(Core :: Security: PSM, defect)
Tracking
()
| Tracking | Status | |
|---|---|---|
| firefox100 | --- | affected |
People
(Reporter: erosman, Unassigned)
Details
Attachments
(2 files)
SSL-cert-2022-03-22.jpg
For many years and for the reasons explained in Bug 1719783 , I have been adding SSL Certificate Exceptions on Nightly.
The SSL certificates belong to Let's Encrypt which are valid for 3 months. However, every 2-3 days, Firefox reports that the SSL certificates are invalid thus forcing the process of manually adding them again.
The previous ones are still displayed in Certificate Manager as Permanent.
Unless Let's Encrypt updates all their SSL certificates few times a week, there must be an issue somewhere.
Example to track: https://104.238.132.173:4443/
|
||
Comment 1•4 years ago
|
||
What does the cert_override.txt file in your profile directory look like?
|
Reporter | |
Comment 2•4 years ago
|
||
At the moment:
# PSM Certificate Override Settings file
# This is a generated file! Do not edit.
forums.rapidpremium.net:443: OID.2.16.840.1.101.3.4.2.1 6D:7A:39:F7:98:4D:B0:A5:D7:31:21:29:74:EA:A8:1E:1C:91:AE:B6:2B:CD:0F:34:A3:67:9F:53:DC:B7:1B:18 M AAAAAAAAAAAAAAAQAAAAk1y8F40IVPmZZR1GnsgA0wkwgZAxCzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAOBgNVBAcTB1NhbGZvcmQxGjAYBgNVBAoTEUNPTU9ETyBDQSBMaW1pdGVkMTYwNAYDVQQDEy1DT01PRE8gUlNBIERvbWFpbiBWYWxpZGF0aW9uIFNlY3VyZSBTZXJ2ZXIgQ0E=
163.47.20.217:4443: OID.2.16.840.1.101.3.4.2.1 AB:76:37:33:9A:7A:AC:8C:36:84:CA:D3:86:86:DA:EE:37:9B:1A:2D:C2:DD:BD:47:28:CF:FD:65:DE:A8:3C:B3 M AAAAAAAAAAAAAAASAAAANAPHtxFeY38v/JAJn0nEChuyfzAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3MgRW5jcnlwdDELMAkGA1UEAxMCUjM=
209.208.63.172:4443: OID.2.16.840.1.101.3.4.2.1 B2:AE:0F:D3:C6:08:B0:DD:0B:E0:BF:DF:B9:C1:A6:83:77:B5:30:7C:03:42:2D:5F:51:FC:D3:15:A1:73:86:34 M AAAAAAAAAAAAAAASAAAANAPGBcqbqis0S9SupkpfLyvo1zAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3MgRW5jcnlwdDELMAkGA1UEAxMCUjM=
185.158.251.136:4443: OID.2.16.840.1.101.3.4.2.1 EB:DE:E7:AE:D2:52:87:1E:59:C6:99:C2:5D:50:AF:55:EB:4B:FE:D1:07:31:A9:84:36:AA:1C:9B:74:6B:0B:6E M AAAAAAAAAAAAAAASAAAANARZIjLAHRAA/Cgzuo2Y+LSB/jAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3MgRW5jcnlwdDELMAkGA1UEAxMCUjM=
104.244.74.82:4443: OID.2.16.840.1.101.3.4.2.1 75:0C:B0:9F:B5:AE:6A:D2:7F:85:F3:45:79:B2:B0:AB:CC:4F:ED:83:D2:51:DB:87:4D:2E:F0:DD:AD:51:74:EF M AAAAAAAAAAAAAAASAAAANATCNuAhauwl6vAU1/zHD7dRPzAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3MgRW5jcnlwdDELMAkGA1UEAxMCUjM=
104.238.190.107:4443: OID.2.16.840.1.101.3.4.2.1 0C:99:FC:4A:5E:81:FC:29:00:A6:F6:9E:F3:E2:5D:4E:BB:FA:8D:3C:51:82:66:43:E7:2C:15:71:DC:6F:61:F7 M AAAAAAAAAAAAAAASAAAANAR5rCzZIJ2jGSX8q4OyLpPYuTAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3MgRW5jcnlwdDELMAkGA1UEAxMCUjM=
104.238.132.173:4443: OID.2.16.840.1.101.3.4.2.1 B9:7A:36:BB:57:3C:07:89:09:AE:BE:07:BF:7B:3F:9D:39:B0:84:36:37:DE:1A:95:D3:7E:9C:4A:F1:50:5C:48 M AAAAAAAAAAAAAAASAAAANAQdvM1ZpFMsEELba45nefv3KzAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3MgRW5jcnlwdDELMAkGA1UEAxMCUjM=
163.47.20.21:4443: OID.2.16.840.1.101.3.4.2.1 43:84:1C:3D:3A:30:DA:FF:4C:3C:00:F8:D8:15:B7:78:75:34:2C:AF:E3:0F:50:28:0D:AF:E3:8E:48:8E:39:51 M AAAAAAAAAAAAAAASAAAANARqcehwar35gXEmyuuNh6PLJTAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3MgRW5jcnlwdDELMAkGA1UEAxMCUjM=
104.254.61.119:4443: OID.2.16.840.1.101.3.4.2.1 4B:94:1A:8A:81:CB:7B:99:54:E9:A5:A4:75:82:35:4C:BF:29:EC:40:5F:DE:73:D4:73:07:5A:46:87:EB:04:DF M AAAAAAAAAAAAAAASAAAANAOjO/IDvdyKqirdw5zTPpHqQTAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3MgRW5jcnlwdDELMAkGA1UEAxMCUjM=
|
|
||
Comment 3•4 years ago
|
||
Great - thanks! When a site stops working, can you attach that file again?
|
|
Reporter | |
Comment 4•4 years ago
|
||
The following has already stopped working
104.254.61.119:4443: OID.2.16.840.1.101.3.4.2.1 4B:94:1A:8A:81:CB:7B:99:54:E9:A5:A4:75:82:35:4C:BF:29:EC:40:5F:DE:73:D4:73:07:5A:46:87:EB:04:DF M AAAAAAAAAAAAAAASAAAANAOjO/IDvdyKqirdw5zTPpHqQTAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3MgRW5jcnlwdDELMAkGA1UEAxMCUjM=
|
|
Reporter | |
Comment 5•4 years ago
|
||
|
|
||
Comment 6•4 years ago
|
||
If you view that certificate, what is its sha-256 hash?
|
|
Reporter | |
Comment 7•4 years ago
|
||
SHA-256
4B:94:1A:8A:81:CB:7B:99:54:E9:A5:A4:75:82:35:4C:BF:29:EC:40:5F:DE:73:D4:73:07:5A:46:87:EB:04:DF
|
|
Reporter | |
Comment 8•4 years ago
|
||
|
|
||
Comment 9•4 years ago
|
||
If you use the dialog in comment 5 to re-add the exception, does it work again? Does doing that result in a different cert_override.txt file?
|
|
Reporter | |
Comment 10•4 years ago
|
||
If you use the dialog in comment 5 to re-add the exception, does it work again?
Yes
Does doing that result in a different cert_override.txt file?
Yes ... Here it is after adding exception
# PSM Certificate Override Settings file
# This is a generated file! Do not edit.
forums.rapidpremium.net:443: OID.2.16.840.1.101.3.4.2.1 6D:7A:39:F7:98:4D:B0:A5:D7:31:21:29:74:EA:A8:1E:1C:91:AE:B6:2B:CD:0F:34:A3:67:9F:53:DC:B7:1B:18 M AAAAAAAAAAAAAAAQAAAAk1y8F40IVPmZZR1GnsgA0wkwgZAxCzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAOBgNVBAcTB1NhbGZvcmQxGjAYBgNVBAoTEUNPTU9ETyBDQSBMaW1pdGVkMTYwNAYDVQQDEy1DT01PRE8gUlNBIERvbWFpbiBWYWxpZGF0aW9uIFNlY3VyZSBTZXJ2ZXIgQ0E=
163.47.20.217:4443: OID.2.16.840.1.101.3.4.2.1 AB:76:37:33:9A:7A:AC:8C:36:84:CA:D3:86:86:DA:EE:37:9B:1A:2D:C2:DD:BD:47:28:CF:FD:65:DE:A8:3C:B3 M AAAAAAAAAAAAAAASAAAANAPHtxFeY38v/JAJn0nEChuyfzAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3MgRW5jcnlwdDELMAkGA1UEAxMCUjM=
104.254.61.119:4443: OID.2.16.840.1.101.3.4.2.1 1C:18:D4:40:D4:C2:15:CD:C4:84:2D:22:2D:27:13:AE:55:6F:2A:20:B1:D6:C2:5E:06:F7:94:55:EF:FD:D1:5A M AAAAAAAAAAAAAAASAAAANAMuzCsEajEeDR+xa0ksBMOxqTAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3MgRW5jcnlwdDELMAkGA1UEAxMCUjM=
185.158.251.136:4443: OID.2.16.840.1.101.3.4.2.1 EB:DE:E7:AE:D2:52:87:1E:59:C6:99:C2:5D:50:AF:55:EB:4B:FE:D1:07:31:A9:84:36:AA:1C:9B:74:6B:0B:6E M AAAAAAAAAAAAAAASAAAANARZIjLAHRAA/Cgzuo2Y+LSB/jAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3MgRW5jcnlwdDELMAkGA1UEAxMCUjM=
104.244.74.82:4443: OID.2.16.840.1.101.3.4.2.1 75:0C:B0:9F:B5:AE:6A:D2:7F:85:F3:45:79:B2:B0:AB:CC:4F:ED:83:D2:51:DB:87:4D:2E:F0:DD:AD:51:74:EF M AAAAAAAAAAAAAAASAAAANATCNuAhauwl6vAU1/zHD7dRPzAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3MgRW5jcnlwdDELMAkGA1UEAxMCUjM=
104.238.132.173:4443: OID.2.16.840.1.101.3.4.2.1 B9:7A:36:BB:57:3C:07:89:09:AE:BE:07:BF:7B:3F:9D:39:B0:84:36:37:DE:1A:95:D3:7E:9C:4A:F1:50:5C:48 M AAAAAAAAAAAAAAASAAAANAQdvM1ZpFMsEELba45nefv3KzAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3MgRW5jcnlwdDELMAkGA1UEAxMCUjM=
104.238.190.107:4443: OID.2.16.840.1.101.3.4.2.1 0C:99:FC:4A:5E:81:FC:29:00:A6:F6:9E:F3:E2:5D:4E:BB:FA:8D:3C:51:82:66:43:E7:2C:15:71:DC:6F:61:F7 M AAAAAAAAAAAAAAASAAAANAR5rCzZIJ2jGSX8q4OyLpPYuTAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3MgRW5jcnlwdDELMAkGA1UEAxMCUjM=
163.47.20.21:4443: OID.2.16.840.1.101.3.4.2.1 43:84:1C:3D:3A:30:DA:FF:4C:3C:00:F8:D8:15:B7:78:75:34:2C:AF:E3:0F:50:28:0D:AF:E3:8E:48:8E:39:51 M AAAAAAAAAAAAAAASAAAANARqcehwar35gXEmyuuNh6PLJTAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3MgRW5jcnlwdDELMAkGA1UEAxMCUjM=
209.208.63.172:4443: OID.2.16.840.1.101.3.4.2.1 B2:AE:0F:D3:C6:08:B0:DD:0B:E0:BF:DF:B9:C1:A6:83:77:B5:30:7C:03:42:2D:5F:51:FC:D3:15:A1:73:86:34 M AAAAAAAAAAAAAAASAAAANAPGBcqbqis0S9SupkpfLyvo1zAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3MgRW5jcnlwdDELMAkGA1UEAxMCUjM=
|
|
||
Comment 11•4 years ago
|
||
104.254.61.119:4443: OID.2.16.840.1.101.3.4.2.1 1C:18:D4:40:D4:C2:15:CD:C4:84:2D:22:2D:27:13:AE:55:6F:2A:20:B1:D6:C2:5E:06:F7:94:55:EF:FD:D1:5A M AAAAAAAAAAAAAAASAAAANAMuzCsEajEeDR+xa0ksBMOxqTAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3MgRW5jcnlwdDELMAkGA1UEAxMCUjM=
This certificate has a different hash. This is the old one: https://crt.sh/?id=6336191532 and this is the new one: https://crt.sh/?id=6381894611, so it looks like they're being updated about once a week. This isn't a bug in Firefox.
Description
•