Firefox certification problems with all HTTPS google sites

Question

Every google site (https://reader.google.com https://mail.google.com, etc) says "Secure Connection Failed www.google.com uses an invalid security Certificate.  The certificate is only valid for a248.e.akamai.net"  If i click to add an exception and "Get Certificate" I get told that Certificate belongs to a different site, which could inidicate identity theft.
Oddly,  midori isn't having this problem and neither is offlineimap when syncing my gmail account.  This is only firefox and only on my Arch computer.
Any ideas?

Answer 1

damjan wrote:
you should also consider the posibillity that someone is trying to hack you
edit: and by "hack you" I mean playing man in the middle, trying to steal your password
I have, that's why I haven't installed the cert.   I find it really odd that my system would be compromised though.  For the following reasons:
The only service I run on my machine(we'll called this Box2) that accepts outside connections is ssh, on a non-default port.  This port cannot be reached from outside of my home network.  My router/firewall for my home (ipCop) doesn't forward a thing to this box.  If I want to ssh to my main pc, I must ssh to another box first (we'll call this Box1), then ssh to this one. 
The router, only accepts on a non-default port from a single ip address to allow ssh traffic through to Box1.  Box1's iptables and tcpwrappers are both set to only accept connections from a single ip for ssh.  Denyhosts is setup to block an ip after 3 failed attempts.
Box2's (the box with the problem) iptables firewall setup is incredibly strict.  I have blocked by default all outgoing and incoming traffic and whiteless exactly what I need only. 
My browser blocks all cookies and javascript by default (noscript and cookiesafe), and my whitelist for both of these are sites that i trust very well.
So while it's possible i've been compromised somehow... and someone's playing a man in the middle attack.. on only one pc in my network (me and my girlfriend are the only ones with physical access and there's no wireless access), I highly doubt it.
here's my iptables rules for the possibly compromised box:
# Generated by iptables-save v1.4.3.2 on Wed May 13 18:53:16 2009
*filter
:INPUT DROP [4:817]
:FORWARD DROP [0:0]
:OUTPUT DROP [12:720]
-A INPUT -s 127.0.0.0/8 -i eth0 -j DROP
-A INPUT -s 192.168.0.0/16 -i eth0 -j DROP
-A INPUT -s 172.16.0.0/12 -i eth0 -j DROP
-A INPUT -s 10.0.0.0/8 -i eth0 -j DROP
-A INPUT -i lo -j ACCEPT
-A INPUT -s 192.168.0.123/32 -p tcp -m tcp --dport 500 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -f -j DROP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j DROP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
-A OUTPUT -p icmp -j ACCEPT
-A OUTPUT -p udp -m udp --dport 53 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 587 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 993 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 20 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 21 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 137 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 138 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 139 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 445 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 5190 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 5190 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 5222:5223 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 5222:5223 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 6667 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 2242 -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 43 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 59155 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 59155 -j ACCEPT
COMMIT
# Completed on Wed May 13 18:53:16 2009
# Generated by iptables-save v1.4.3.2 on Wed May 13 18:53:16 2009
*nat
:PREROUTING ACCEPT [4:817]
:POSTROUTING ACCEPT [9:1034]
:OUTPUT ACCEPT [21:1754]
COMMIT
Last edited by scv5 (2009-06-07 19:18:01)