Site with self-signed cert no longer loads in FF 4

When attempting to load a page with aself-signed cert, one that previously loaded in 3.x, I now get the following error:
Renegotiation is not allowed on this SSL socket.
(Error code: ssl_error_renegotiation_not_allowed)
I was accessing via https.

See:
* http://wiki.mozilla.org/Security:Renegotiation

Similar Messages

ASA5505 IPSEC only with Self-Signed certs

Hello all,
I have limited Cisco training and have been tasked with a pilot project. We have scavenged the ASA from another department, but I have no access to support. It's running ASA v9.1 and ASDM 7.1 . If all goes well I'll be sent on training and we will be purchasing a nice 5520.
So I've scoured the internet for an easy guide to do as my tittle says, but am having major difficulties. I can find lots of support for SSL VPN with Self-signed or IPSEC VPN with externally signed certs but I can't get ASA self-signed IPSEC IKEv2 only with certificate authentication. Also, to make it even worse, I need to provide the user with the software, profile and certificate by hand. No web-access portal or download.
If you know where I can get good setup guide for this type of use please by all means save me here . If this isn't even possible I'm cool with that, just let me know.
Thanks fo any help you can provide
Jay

If the ASA is using a certificate issued by a CA that is in the client's trusted root CA store, then the ASA identity certificate does not need to be imported by the client.
That's why it's generally recommend to go the route of using a well-know public CA as they are alreay included in most modern browsers and thus the client doesn't need to know how to import certificates etc.
If you are using a local CA that is not in the client's trusted root CA store to issue your ASA identity certificate or self-signing certificates on the ASA then you need to take additional steps at the client.
In the first case, you would import the root CA certificate in the trusted root CA store of the client. After that, any certificates it has issued (i.e the ASA's identity certificate) would automatically be trusted by the client.
In the second case, the ASA's identity certificate itself would have be installed on the client since it (the ASA) is essentially acting as it's own root CA. I usually install them in my client's Trusted Root CA store but I guess that's technically not required, as long as the client knows to trust that certificate.

IMAP SSL doesnt work in iOS 8.0.2 with self-signed cert.

Got several mailaccounts setup on my iPhone, four of them is LDAP SSL with the server running self-signed cert (expires 2039).
When I upgraded to iOS 8.0.2 (iPhone 5S) I got problem with Network settings so I did a "Reset Network Settings" (General > Reset).
After that all my LDAP SSL based emailaccount cannot be "Verified". I have tried reinstall them all but cannot even set them up anymore!!
I then setup with EXACTLY the same settings in Mail on my MacAir and it did work like a charm instantly. (Im working as a IT Tech so this is peanuts).
I have even tried to import the certificate (.pem) from Keyaccess Chain into my iPhone. So that one is installed.
In older iOS you could tell "Continue" when it said "Certificate is not trusted". Just clicked Continue and it worked anyway!
What to do?
In iOS 8.0.2 this is not showing to accept the certificate! Now it only shows:

Nothing anyone here can do, but you should report it to Apple: http://www.apple.com/feedback/

IMAP with self-signed certs?

I don't yet have my iPhone (ordered online), but I'm wondering if the email client can use IMAP servers via SSL that use a self-signed certificate. Can anyone test that or confirm/deny it based on some kind of published Apple documents or something? I haven't found a solid answer in my searchings.

I can tell you it was a PITA to get working - I first tested sans ssl, then had to reset the iPhone before it would completely forget the old mail config (due to my playing w/ :port# tacked onto the hostname). Plus the iPhone docs need a small amount of work, I think.
Is courier listening on port 993 for imaps? That's what the iPhone will use when you turn on 'secure incoming'.
Setting the :port# in the server field only works for the outgoing server. Don't explicitely set it for incoming, else you'll go through the same aggravation I did (and eventually reset and enter it from scratch).

Hi, is there any way to forbid access to web site with self-signed certificate or obsolete certificate and disable exceptions, in Firefox V17+ ?

(There should be the warning message, without the ability to add any exceptions.)

Hi,
There are Certificate preferences in Options> Advanced, I recommend exploring these options and testing a few self-assigned certificates.
Third Party Reference:
[http://www.hackerfactor.com/blog/index.php?/categories/3-Network]

"I do not get any message or option to add exception" - Using Self signed cert -Images does not load

Wr are have two web servers one for app and another for loading images. Both are behind Kemp Load balancer and are using self signed certs from the load balancer. The images does not load when using Firefox 3.x. I load with IE and Firefox 2.x. With firefox 3.x it does not give a message to "add exception". I only get one certificate message to add exception for the app server. I do not get the certificate message or pop up for the imaging server with Firefox 3.x.
== This happened ==
Every time Firefox opened
== Always ==
== User Agent ==
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)

You have a lot of information in packed in the "More system details..." (in the right-hand column), where it looks like you found a solution. If not take a look at "Problematic Extensions" the AVG Free installation of their "'''AVG Free Search'''" can cause such problems. Directions to fix that are specific and involve reinstalling AVG Free without the Link Scanner component.
* http://kb.mozillazine.org/Problematic_extensions

Issue with self-signed Extensions

I am packaging my extension with self signed cert that is created with the ZXPSignCmd executable.
It functions correctly and the -verify command confirms the ZXP is good to go.
When a user install the extension, however, it only functions once the first time they open Illustrator after installing it. Every time after that, when Illustrator is opened, the panel is completely blank.
This issue can be resolved by enabling PlayerDebugMode on the end-user's .plist file (as outlined for developers in the blog) but obviously this is something I do not want the end user doing. Does anyone have insight as to why the extension panel only loads once, and then breaks? Enabling PlayerDebugMode addresses the issue, but I can't figure out why. I assume is has something to do with the the way it is signed, but I would like confirmation/clarification if anyone knows what is going on.

Ok, I've validated my html and I'm getting a few errors related to Angular. They're all one of two types of errors
Error 1:
<div ng-controller="ExampleController">
Gets the following error:
Attribute ng-controller not allowed on element div at this point.
Error 2:
<my-directive></my-directive>
Gets the following error:
Element my-directive not allowed as child of element div in this context. (Suppressing further errors from this subtree.)
Error 1 is for any Angular related thing...ng-click, ng-controller, ng-show, etc.
Error 2 appears where all my custom directives are.
I did a comparison between the not-working extension and a working one that also uses Angular (without any custom elements). When I validated the working extension, it returned a bunch of Error 1's but no Error 2's (this is expected, seeing as there are no custom elements).
To your question about dynamic HTML - there is none. All of the files are static after they're installed. I double checked this by running a diff-merge between the extension before and after it has been run once. They are exactly the same, so no files are changing.
There are known issues with custom directives in older browsers like IE8 - http://www.befundoo.com/blog/angularjs-directives-in-ie8/
Out of curiosity, I tried adding elements in the head, as described in the above blog, inside my extension. This did not have any effect, and the extension still fails.
I'm considering rewriting my directives as attributes instead of elements, and seeing if that does it. That would take some time though, so if the above info helps narrow down the problem or raises other questions of yours, I'm all ears! Thanks again for all the replies!

Http Analyzer connecting to server with self-signed SSL cert

When making webservice calls using Axis 1.3 to our development site that uses a self-signed SSL cert I am getting the following error when running the Http Analyzer:
javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
Works fine if I turn off proxy in run configuration for project or when used against a site with a purchased cert. I assume the problem is with Http Analyzer not being able to find the server cert in a local keystore, is there a way to import the cert so that I can run Http Analyzer against the site?
Tried adding server cert to <jdkhome>/jre/lib/security/cacerts keystore but still have the problem.
Am using JDeveloper 10.1.3.
Thanks,
John

I fixed that by getting certs from: https://www.startssl.com/?app=1.
The certs are free and work fine.
Since Iphone 4 apple does not accept unknown CA Authorities.

Anyone having issues with Self-Signed SSL-certs on mail servers?

Can't get it to allow connecting via SSL to outgoing mail servers with self-signed certificates. Problem did not exist in earlier versions of OSX as far as I know.

YES. I have a cert from lunarpages, where my accounts are hosted. I'm seeing two issues, and they are different for the different servers at lunarpages:
1. Multiple logins from different machines --> problem
2. Multiple accounts accessing same server --> problem
So, with 1 account on one of lunarpages machines, I can have several machines running Mail with ssl on at the same time and get no problem (that is, once I've saved the certificate and marked it trusted). But as soon as another account (my wife's email on the same domain, for example) tries to access the same server, it gives me an ssl error, a choice to save that cert. and if I do then my account will generate the ssl error. Seems like only one account can have the certificate.
On another account on a different lunarpages machine, I can't have several machines running Mail at the same time, only the first will get through and the rest will give an SSL error.
Lunarpages says they can't find a problem, though my last email with them told me to use TLS rather than SSL. Of course, there's no way to specify that in Mail anyway, but I'd thought Mail automatically used TLS anyway, and I'm running the right ports (587 for smtp, 993 for incoming).
Feels like it's an issue with Mail or the OS's handling of certificates. Any clues on a fix will be most appreciated as this is getting annoying. I've had to turn off SSL on my wife's and daughter's accounts just so that I can use it. And I have to quit Mail so that on the other account I can get my mail on my iPhone. Having to quit Mail on my main work machine is frustrating -- if I forget to do it I can't get mail.

Self-Signed Cert being advertised on load-balance ip for ASA VPN cluster

We recently saw an issue potentially related to CSCul61231 when a self-signed certificate was applied to the internal interface of the lan (inside) connection. For some reason, the public (outside) cluster ip address started handing out the self signed cert instead of the configured certificate. Lan interfaces certificates for either of the ASA's in the cluster were not effected - only the VIP. Even after removing the code, the issue still occurred until the cluster was broken. After re-connecting cluster issue did not come back. We are not using the 5500-X devices but instead 5550's. We do have 9.1.(x) running - I think 9.1.2, but not confident.
We were looking to add a self-signed static cert as best practice dictates - but if this is the issue we can't and will have to replace our UC cert with one that contains the inside interfaces dns as well. Can anyone confirm this to be the case? Below is the exact line that caused the issue.
ssl trust-point TrustPoint_X INSIDE vpnlb-ip ssl trust-point TrustPoint_X INSIDE
Thanks in advance!

Just wanted to follow up and confirm we have 9.1(5)12 running on the devices. A note in the bug report suggest a possible ip6 address is associated in some way. I want to also point out the devices have only ipv4 address assigned.
Anyone that can confirm this functionality would be greatly appreciated.
Thanks!

Activate SSL with OpenSSL Self-Signed Cert

Dear Expert,
Anyone can give me guidance on how to activate and create ssl cert in Java IM using openssl self-signed cert.
thanks

Here how I make it work. Some of the tips is from jay in this forum
Instant Messaging with SSL
Let say I have Messaging, Directory, IM server in 1 box.
Let's create a cert
# cd /etc/opt/SUNWiim/default/config/
a) Sun [TM] ONE Messaging Server 6.1 and Sun [TM] ONE Directory Server 5.2 were installed from JES2 on the same box
b) The server_root directory for Directory Server is the default: /var/opt/mps/serverroot
c) The server_root directory for Messaging Server is also the default: /opt/SUNWmsgsr
1. Login to the console and do a Certificate Request
a) cd /var/opt/mps/serverroot
b) ./startconsole &
c) Login to the main console as "cn=Directory Manager"
d) Select and open the "Messaging Server" console
e) Highlight the tab called "Tasks" at the top
f) Select "Manage Certificates"
g) Console will ask for a password for the security database. Please enter a password twice and make sure that you remember it. This will create the following two files under "/var/opt/mps/serverroot/alias" directory:
-rw------- 1 mailsrv other 65536 Aug 12 13:57 msg-config-cert8.db
-rw------- 1 mailsrv other 32768 Aug 12 13:57 msg-config-key3.db
NOTE: Please make sure that:
- either the owner of the files is the messaging server user ( mailsrv in this case ),
-or the permission is appropriate for the mail server user to at least read it.
h) Once you reach the "Manage Certificate" window, please make a "Certificate Request" by filing up the appropriate questions
i) Once you are done, you get a CSR , which looks something like this:
-----BEGIN NEW CERTIFICATE REQUEST-----
MIIBszCCARwCAQAwczELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWE x
DzANBgNVBAcTBm5ld2FyazEMMAoGA1UEChMDc21pMQ0wCwYDVQQLEwRhdGFjMSEw
HwYDVQQ DExhwb3BleWUuYXRhYy5lYmF5LnN1bi5jb20wgZ8wDQYJKoZIhvcNAQEB
BQADgY0AMIGJAoGBALF eXVTFDj/1eONPzV/dAZ0dBKdstl+u+L/DTdw1sCXXOdNG
MzYeTUu9g/g0dXL/bniF31M0OkoW+6O 5mshySv/KXS9QcoPngSKS6wuL8kNlYKQR
Dw97WCS1uaqubAK/kir4hDmL7X9Rf29EFHDSFOWjeOJ /M7aqFWCfR5sTeSIFAgMB
AAGgADANBgkqhkiG9w0BAQQFAAOBgQCeYwptiL/j7Bcs0DtGYiOlMMs utezF1COC
4+wHt/p+LtQkvQWBoXisqN6YlGfZPXOCdUyA+RwU7BxjX9IQLP+9HLHfQyLzvCKb
boKKpjIc8Ci+tmibM5QkgTxu4L7yeCR/PiplgVPttHNT2Qr9cxHLLBvIO6N1GOE8
VBoq0pC5SA= =
-----END NEW CERTIFICATE REQUEST-----
Please maintain and preserve this CSR , since you will be sending it to the Certificate Authority ( CA ) so they can issue you a Certificate
# openssl genrsa -des3 -out ca.key 4096
# openssl req -new -x509 -days 3650 -key ca.key -out ca.crt
# openssl x509 -req -days 3650 -in file.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out server-cert.crt
# cp -p /var/opt/mps/serverroot/alias/msg-config-key3.db key3.db
# cp -p /var/opt/mps/serverroot/alias/msg-config-cert8.db cert8.db
# cp -p /var/opt/mps/serverroot/alias/secmod.db .
# cat sslpassword.conf
Internal (Software) Token:password
# cat /etc/opt/SUNWiim/default/config/iim.conf
iim.comm.modules = "iim_server,iim_mux,iim_wd"
iim.smtpserver = "www.esuria.com.bn"
iim.instancedir = "/opt/SUNWiim"
iim.instancevardir = "/var/opt/SUNWiim/default"
iim.user = "root"
iim.group = "root"
iim.config.version = "1.1"
iim_ldap.host = "www.esuria.com.bn:389"
iim_ldap.searchbase = "o=esuria.com.bn,dc=esuria,dc=com,dc=bn"
iim_ldap.loginfilter = "(&(objectclass=inetorgperson)(uid={0}))"
iim_ldap.usergroupbyidsearchfilter = "(|(&(objectclass=groupofuniquenames)(dn={0
}))(&(objectclass=inetorgperson)(uid={0})))"
iim_ldap.usergroupbynamesearchfilter = "(|(&(objectclass=groupofuniquenames)(cn=
{0}))(&(objectclass=inetorgperson)(cn={0})))"
iim_ldap.allowwildcardinuid = "False"
iim_ldap.userclass = "inetOrgPerson"
iim_ldap.groupclass = "groupOfUniqueNames"
iim_ldap.groupbrowsefilter = "(objectclass=groupofuniquenames)"
iim_ldap.searchlimit = "40"
iim_ldap.userdisplay = "cn"
iim_ldap.groupdisplay = "cn"
iim_ldap.useruidattr = "uid"
iim_ldap.groupmemberattr = "uniquemember"
iim_ldap.usermailattr = "mail"
iim_ldap.resynctime = "720"
iim_ldap.usergroupbinddn = "cn=Directory Manager"
iim_ldap.usergroupbindcred = "password"
iim_ldap.useidentityadmin = "false"
iim.log.iim_server.severity = "INFO"
iim.log.iim_mux.severity = "ERROR"
iim.log.iim_wd.severity = "ERROR"
iim_server.domainname = "esuria.com.bn"
iim_server.useport = "True"
iim_server.port = "5269"
iim_server.usesslport = "False"
iim_server.sslport = "5223"
iim_server.enable = "True"
iim_server.clienttimeout = "15"
iim_server.usesso = "0"
iim.policy.modules = "iim_ldap"
iim.userprops.store = "file"
iim_mux.listenport = "www.esuria.com.bn:5222"
iim_mux.serverport = "www.esuria.com.bn:45222"
iim_mux.enable = "true"
iim_mux.numinstances = "2"
iim_mux.maxthreads = "10"
iim_mux.maxsessions = "1000"
iim_mux.usessl = "on"
iim_mux.secconfigdir = "/etc/opt/SUNWiim/default/config"
iim_mux.keydbprefix =
iim_mux.certdbprefix =
iim_mux.secmodfile = "secmod.db"
iim_mux.certnickname = "server-cert"
iim_mux.keystorepasswordfile = "sslpassword.conf"
iim_wd.enable = "true"
iim_wd.period = "300"
iim_wd.maxRetries = "10"
-open http://www.esuria.com.bn/im/en/im.jnlp
-click More Detail and enable Use SSL

Old clients won't switch from Self-Signed Certs to PKI.

Greetings.
I am wondering if anyone can give me advise on problem I am having with some of my sccm clients.
When I originally deployed SCCM i used self signed certs on clients.
We needed to add MAC and Linux support and MAC clients won't work without PKI, so I following this http://technet.microsoft.com/en-us/library/gg682023.aspx to configure Certificate Authority.
It all seemed work well, I can now join MAC client with auto-enroll and all machines are requesting client certificates and I had couple of machine with new push on windows site installed with PKI.
So right now I have about 250 windows clients, only 22 of them use PKI and the rest keeps using self-signed certs.
I foolishly switched main site settings, MP settings and DP point settings to use https only.
As a result I lost all self-signed clients and have full log for mpcontrol saying that it's rejecting clients cause they certificate cannot be validated.
I logged in to couple of those machines and MMC i can see that it did enroll machine with valid Client Cert but Configuration Manager client itself still saying that it's using self signed one.
Am I missing a step that I need to do to make sure that all those clients switch to PKI?

It is. but how can i redeploy them?
I was under impression auto push won't reinstall them. If i do deployment - that seem to reuse existing configuration and still use self signed on old machines.
How can i verify that it does push clients to machine that already have it correctly and start using new config and not reuse old one.
I even tried removing clients from couple of machines and see if it gets pushed again on them with proper config and those machines don't seem to get client but used to get it fine before. I keep getting new machines being added to domain and they get client
pushed to them, but anything that had client with self signed doesn't seem to be happy.

SCCM 2012 Default self signed Cert expired...

SCCM 2012 Default self signed Cert expired - how do I renew it?

The default selfsigned cert that gets generated with the installation - can be found in administration - security - Certificates (This is Sccm 2012 RTM)
Yes, I know this is an old post, but I’m trying to clean them up. Did you solve this problem, if so what was the solution?
I will bring this back to Kent point, which one of the Certs are you talking about. You can see form the screenshot that I have 6 certs, 3 DP and 3 Boot cert. You can also see that the 3 DP server have a 100 year life and the 3 Boot certs only have 1 year.
If you are talking about the boot certs then just create the boot image.
Garth Jones | My blogs: Enhansoft and
Old Blog site | Twitter:
@GarthMJ

How do I allow self-signed cert for SecureAMF on iOS?

I have spent the better part of two days trying to figure out how the dickens to do this.
Basically, I am using BlazeDS (using AMF as the protocol) to communicate with a Java backend (using tomcat with a self-signed cert).
This works great in the browser version of the application (you usually get a little prompt saying that the site is untrusted when you try to access the website, you install the certificate and Bob's your uncle.)
However, adapting the code over to iOS I am discovering a couple of problems. The primary one being that the BlazeDS communication fails miserably when we are using SecureAMF with the self-signed certs. It appears that it is similar to this issue: http://forums.adobe.com/message/3940214#3940214
How do I get my iOS Air app to communicate with a self-signed certificate running on tomcat?
Here are the things I've tried:
1) Installing the cert using iPhone Configuration Utility
2) Browsing to the site in Safari, and installing the certificate manually
This is for development, so buying a certificate doesn't really make sense.
So, any suggestions?

Has anybody had any success here? This is a real problem for testing internal applications inside of a local network.

Weblogic self-signed certs

Hi Guys, wanted to know whether it's ok to use self-signed certs in prod env when the weblogic server is sitting in DMZ including other down/up stream systems and end users will access the apps via protected proxy servers.

Hi,
Following is the standard way of creating self signed certificates..."keytool" is a utility which comes along with JDK installation.
keytool -genkey -alias mykey -keyalg RSA -keysize 1024 -dname "CN=aaa.bbb.com, OU=Customer Support, O=MyOrganization, L=Denver, ST=Colorado, C=US" -keypass mykeypass -keystore identity.jks -storepass mystorepass
keytool -selfcert -v -alias <alias> -keypass -keystore .jks -storepass <store password> -storetype jks
keytool -export -v -alias <alias;> -file <root cert>.der -keystore <key store>.jks -storepass
keytool -import -v -trustcacerts -alias <alias> -file <root cert>.der -keystore <key store>.jks -storepass
for detailed informations please visit: http://java.sun.com/j2se/1.5.0/docs/tooldocs/windows/keytool.html
Thanks
Jay SenSharma
http://jaysensharma.wordpress.com (WebLogic Wonders Are Here)
Edited by: Jay SenSharma on Feb 4, 2010 5:00 PM

Site with self-signed cert no longer loads in FF 4

Similar Messages

Maybe you are looking for