Ssl_error_internal_error_alert error in firefox when connecting to an internal website with self signed certificate.

Firefox 26.0 . The website is running on tomcat 7 server . Using java key store .java version "1.6.0_29"
Can test the site with openssl s_client and response seem ok.
SSL handshake has read 2335 bytes and written 303 bytes
New, TLSv1/SSLv3, Cipher is EDH-RSA-DES-CBC3-SHA
Server public key is 4096 bit
Secure Renegotiation IS supported
SSL-Session:
Protocol : TLSv1
Cipher : EDH-RSA-DES-CBC3-SHA
Session-ID: 52B896D8E3B7D0B1A03C5D2E5FF8B594D6AA74E94CB193E24685A041C5BEBF3A
Session-ID-ctx:
Master-Key: 1063AB71B3389D139FD7DD490FE3DF2188FA24B5E090390D2A899B32E2895B1D7A093590BE8D6FCDEFD22ACF10D94544
Key-Arg : None
Start Time: 1387828953
Timeout : 300 (sec)
Verify return code: 18 (self signed certificate)
closed

Hello,
Can you please confirm what the issue is? Are you not able to setup a SSL connection to the internal website running on Tomcat. If so, have you tried installing the root CA certificate into Firefox? You can do that by going to Firefox -> Preferences -> Advanced -> View Certificates -> Certificate Authorities and then importing the root CA certificate.
Please check this and let us know if this helps in resolving the connectivity issue. Though, I am a bit surprised that the connection is not getting established. Typically, Firefox would warn you if you would like to continue with the connection. Are you not seeing this warning?
Thank you

Similar Messages

  • Problem connecting to HTTPS host with self signed certificate

    I have set up a tomcat server with SSL running in a vmware on my machine using a self signed certificate. I can connect to this no problem with a browser from my main machine with the url https://myserver:8443.
    However, I am not able to connect with a Java client. I always get the below exception. I read that I need to add it as a trusted certificate in the keystore. I went to the site with firefox and saved the certificate as a .cer file, and imported it into the default keystore at c:\users\louis\.keystore. I still have the same problem. I think the problem is the client is not using the keystore, and I don't know how to make it do so. I tried adding the following argument to the run command:
    -Djavax.net.ssl.trustStore=c:\users\louis\.keystore -Djavax.net.ssl.trustStorePassword=changeit
    but it doesn't help.
    Here is the exception I'm getting:
    javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
         at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:174)
         at com.sun.net.ssl.internal.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1611)
         at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:187)
         at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:181)
         at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1035)
         at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:124)
         at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:516)
         at com.sun.net.ssl.internal.ssl.Handshaker.process_record(Handshaker.java:454)
         at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:884)
         at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1112)
         at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1139)
         at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1123)
         at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:434)
         at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:166)
         at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1049)
         at sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(HttpsURLConnectionImpl.java:234)
         at Test.main(Test.java:39)
    Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
         at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:285)
         at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:191)
         at sun.security.validator.Validator.validate(Validator.java:218)
         at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:126)
         at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:209)
         at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:249)
         at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1014)
         ... 12 more
    Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
         at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:174)
         at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:238)
         at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:280)
         ... 18 more

    I have worked around this problem by configuring the Java client to trust all certificates and disabling hostname verification. That way I don't need a trust store. I'll just have to remove that code in production. Not ideal since I'd rather have certificate/hostname verification working for testing, but it works at least.
    I have looked at the Java security documentation and as far as i can tell a keystore and trust store is still basically the same type of file and created the same way with the keytool. The difference is when you import a cert you use the -trustcacerts option. The client 'keystore' is only being used to store the trusted cert, so it essentially is a trust store. This is documented in the keytool doc for the command -importcert.
    http://download.oracle.com/javase/6/docs/technotes/tools/windows/keytool.html
    I actually think my problem is more to do with the hostname, since my server doesn't have a real domain hostname like www.myserver.com. I am just using the machine name for the host, although web browsers do not have a problem with this. When I set my java client to trust all certs, I was getting the following error:
    java.io.IOException: HTTPS hostname wrong
    Disabling hostname verification fixed this, so I'm wondering if my cert has the wrong hostname. I originally created the self signed cert using the keytool with the command -genkey, which creates a key pair and also a self signed cert. I looked at the keytool docs, and I don't see any way of specifying the hostname or even seeing what the host name of a cert is. What does it put as the hostname by default? The IP address or machine name, or am I understanding this wrong?

  • Safari could not establish secure connection to my localhost with self signed certificate

    was using maven+grizzly+jersey to start my own server. I created self signed certificate so that my server can support https. I case you are curious, following is how I generated my certificate
    I was testing this on my iMac (Running Mavericks) Now, I added the server.cert to the system keychain so that all users can trust this certificate. Also, I change the trust level to "Always Trust".
    I get this work in Chrome and Firefox. They asked me to add exception for this certificate, I did and then everything goes fine. However, I have never make Safari(7.0) happy. I always get the error saying that Safari cannot establish secure connection to my localhost.
    Does anyone have any idea why it happened? Or is there better way to debug this problem so that I will be able to tell at which step things goes wrong.
    Thank you in advance. I really appreciated it.

    Any help much appreciated!

  • When connecting to an internal website, I'm getting an error: "Certificate contain unknown critical extension." What does this mean?

    I am getting a connection failure when trying to connect to an internal web site:
    Secure Connection Failed
    An error occurred during a connection to <sitename>.
    Certificate contains unknown critical extension.
    (Error code: sec_error_unknown_critical_extension)
    Can you give me a general idea what the error is and why I would be getting this error?
    Thanks in advance...

    The instructions here might help
    http://support.apple.com/kb/TS3297

  • Has anyone succesfully used home hosted Firefox sync with self-signed certificate in Android? How?

    I have Firefox sync running on home server. All other devices (Windows, Mac, Linux, Meego) work fine, but Android (4.2 Asus tablet and Samsung phone) Firefox stops at ssl handshake (referring to Apache logs).

    You need to somehow get the certificate on your computer.  After that send it to your phone via bluetooth/cable to one of the Documents directories (phone or mem card). After that rename it with the file manager on the phone and open the now .der file. It'll ask you if you want to install the certificate.  Btw the link you provided does have a der suffix, but the linkis broken.
    Message Edited by jruiseco on 12-Jun-2009 11:08 PM

  • Hi, is there any way to forbid access to web site with self-signed certificate or obsolete certificate and disable exceptions, in Firefox V17+ ?

    (There should be the warning message, without the ability to add any exceptions.)

    Hi,
    There are Certificate preferences in Options> Advanced, I recommend exploring these options and testing a few self-assigned certificates.
    Third Party Reference:
    [http://www.hackerfactor.com/blog/index.php?/categories/3-Network]

  • HT1665 I face an error message Oxe800012 when connecting iphone 4s to the computer, any help please ?????

    I face an error message Oxe800012 when connecting iphone 4s to the computer, any help please ?????

    See this support article: http://support.apple.com/kb/TS3221

  • Why, when I successfully connect to Server 2012 Essentials R2 via Anywhere Access does the Remote Desktop Connection use the self signed certificate for RDP instead of the SSL certificate I installed when I set up access anywhere?

    Scenario:
    Windows Server 2012 R2 Essentials
    I purchased an SSL Cert from GoDaddy and I managed (after some challenges) to set up Anywhere access to use that new SSL Cert. I to rebooted the server and I am able to login to Anywhere Access vis https (using the SSL certificate) from PC, Mac and iOS.
    So far so good.
    The problem I am having is that when I click to launch a remote desktop connection to the server RDP connection wants to use the self signed SSL certificate of the server rather than the SSL Certificate I installed into Anywhere Access. As a result, I get
    a security warning like this: "The identity of the remote computer cannot be verified. Do you want to connect anyway?"
    The name in the certificate appears as ACME-SERVER.ACMEDOMAIN.local  instead of the SSL Certificate I installed, which is
    remote.acmedomain.com
    If I lick to accept, RDP does work fine, it;s just using a self signed certificate. I want it to use the trusted certificate that I purchased and installed.
    My guess is that there must be an additional step to tell Anywhere Access that when it generates the RDP session that it should use the cert? OR, is this just how it works?

    Because....
    the server does not have a 'trusted' certificate assigned to it.
    Only the RDP Gateway has the trusted certificate for the external name.
    If you want to remove that error, you have to do one of the following:
    Make sure your domain uses a public top level domaim, and get a public trusted certificate for your server.
    So, something like,
    server.domain.publicdomain.com
    Or,
    Install that certificate on your remote computer so it is trusted.
    Robert Pearman SBS MVP
    itauthority.co.uk |
    Title(Required)
    Facebook |
    Twitter |
    Linked in |
    Google+

  • Possible to select self-signed certificate for client validation when connecting to VPN with EAP-TLS

    In windows 8.2, I have a VPN connection configured with PPTP as the outer protocol and EAP : "Smart card or other certificate ..." as the inner protocol. Under properties, in the "When connecting" section I've selected "Use a certificate
    on this computer" and un-checked "Use simple certificate selection".
    My preference would be to use separate self-signed certificates for all clients rather than having a common root certificate that signed all of the individual client certificates. I've tried creating the self-signed certificate both with and without the
    client authentication EKU specified, and I've added the certificate to the trusted root certificate authority store on the client. But when I attempt to connect to the VPN I can not get the self signed certificate to appear on the "Choose a certificate"
    drop down.
    Are self signed certificates supported for this use in EAP-TLS? If it makes a difference, I'm working with makecert (not working with a certificate server).
    TIA,
    -Rick

    Hi Rick,
    Thank you for your patience.
    According to your description, would you please let me know what command you were using to make a self-signed certificate by tool makecert? I would like to try to reproduce this issue. Also based on my experience, please let me
    know if the certificate has private key associated and be present in the local machine store. Hence, please move the certificate from the trusted root certificate authority store to personal store.
    Best regards,
    Steven Song
    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

  • Have published iweb site for five years with no problems and just opened a new site and get - 404: Page not found  This error is generated when there was no web page with the name you specified at the web site.-is the problem with iweb or with hosting?  T

    I am sorry if thie is republished-My first time doing this and I am not sure what goes where and where to hear feedback.
    Have published iweb site for five years with no problems and just opened a new site and get -
    404: Page not found 
    This error is generated when there was no web page with the name you specified at the web site.-
    Troubleshooting suggestions:
    Ensure the page you are linking to exists in the correct folder.
    Check your file name for case sensitivity . Index.htm is not the same as index.htm!
    Temporarily disable any rewrite rules by renaming your .htaccess file if it exists
    is the problem with
    iweb or with hosting?
    One Apple tech started to fix Iweb and had to end session and the next said problem with hosting at Network Solutions as it published
    to local folder. NWS has checked sttting a few times-
    Any help would be extremely appreciated as trying to fix this for about five weeks
    Thanks VG
    <Email Edited by Host>

    It's a really bad idea to post your email address - it's an invitation to spam - and I've asked the Hosts to remove it. (Even though I've now noticed you mis-spelled it! - anyway, never post your address in a forum.)
    You have a site here: http://virginiagordon.com/www.virginiagordon.com/WELCOME.html
    If that's not the page you are having trouble with, what is that page's URL?

  • In Firefox 4.0 with a Server with a self signed certificate using IPv6 I can not add a "Security Exception" for this certificate.

    In Firefox 4.0 I have a server ... it contains a self signed certificate. Using IPv6 I can not add a "Security Exception" for this certificate.
    1. I log onto the server (using IPv6). I get the "Untrusted connection page" saying "This connection is Untrusted"
    2. I click on "Add Exception.." under the "I understand the Risks" section.
    3. The "Add Security Exception" dialog comes up. soon after the dialog comes up I get an additional "Alert" dialog saying
    An exception occured during connection to xxxxxxxxx.
    Peer's certificate issuer has been marked as not trusted by the User.
    (Error code sec_error_untrusted_issuer).
    Please note that this works in Firefox 3.6.16 (in IPv4 and IPv6). It also works in Firefox 4.0 in IPv4 only IPv6 has an issue. What's wrong?

    Exactly the same problem, except I'm using FF v6 for Windows, not FF v4 as for the lead post. This is for a self-cert which IS trusted, although the error message says it isn't.

  • How to register iOS device when using self signed certificate with apple Server?

    Hi,
    I have installed the server.app by Apple and used a slef signed certificate for my server. Now I want to register my different devices (iMac, iPhone etc.). I could register the iMac without problesm (I just had to add my self signed certificate to the trusted certificates)
    Sadly, with the iPhone it is not that easy. I can install the "trust profile", but still after that I can not register my device. It seems like it does not accept my self signed certificate for device registration. When adding a registration profile, I get the error "www._mydomain_.tld/devicemanagement/api/device/auto_join_ota_service" is not valid.
    Nethertheless, I can install a profile with setting, e.g. my imap settings, via the profile management without problems.
    Does anyone have an idea how to get around the problem with the self signed certificate?
    Best regards

    Try deleting the Server.app and download it again from the App Store, restart.
    My Server is also using self signed certificates and is working with iOS device (Trust Profile needed first).

  • Firefox application quits unexpectedly on various websites with no pattern: firefox-bin [770]

    Firefox application quits unexpectedly on various websites with no pattern. Part of the error message details reads "firefox-bin [770]"
    It started happening this AM after I visited facebook and got an invite from someone I don't know. I didn't reply. Ever since, I can only browse Safari but for a few pages until it quits.
    Please help.
    Thank you.

    Run /Utilities/Console and click 'All Messages' top left - look for the entries around the quit times and see if they give any pointers why the apps are quitting ? If you're not sure what the lines mean copy and post (just those not the whole log) here.
    There may also be some clues in /Library/Logs/Crash Reporter nameofapplication_date

  • Can we connect Outlook with Exchange 2013 with the default Self-signed certificate?

    Hi,
    the question is very simple, but after several days searching in this forums and in the web I have not been able to find a definitive answer YES or NOT. I know that Self-signed certificates are not for a production enviroment and only for labs and we must
    purchase a third party certificate or get one from a internal CA.
    Anyone can answer this question with no doubt?
    Thanks in advance!
    jspt

    Hi Abhi,
    I wrote this question because in a recent migration to 2013 from 2007 we've found with this problem: you can view it in the post http://social.technet.microsoft.com/Forums/exchange/en-US/1ddd1e81-1061-4461-95dd-13de653ef8fe/outlook-cant-connect-with-exchange-2013-after-migration-from-exchange-2007?forum=exchangesvrdeploy.
    Also I have installed a new exchange 2013 in a lab enviroment and I also have unabled to connect from a Outlook 2013. The problem is the same Outlook is unable to detect the exchange server. Many people in this forums told me that have to be a certificate
    problem and for that I posted this question. Honestly, I don't know how to do for Outlook can be connect with Exchange 2013. I don't know what I'm doing wrong.
    Anyway thanks for your answer.
    jspt

  • SCCM 2007 - task sequence - prestaged media - self-signed certificates - error message 'Certificate has expired for this media'

    Hi there
    Quick scenario.
    We have created a task sequence prestaged media .wim file (SCCM 2007, client OS is Windows XP).
    Recently some of these swap-out machinses, on delivery and start up, have started showing this message:
    'Certificate has expired for this media'.
    This is because the self-signed certificate created during the prestaged media creation process has expired.
    My question is: is it possible to mount the image using dism or imagex and then inject an updated sertificate?
    Best regards
    John

    the disk that has the prestaged media applied must be the boot partition.
    create a task sequence to stage the prestaged media. In this task run a format and partition step which configures both the system disk and the os disk, though make the os disk the active boot partition. Then apply the prestage wim.
    On your deploy task, somewhere after the OS has applied create a group that runs only if the media is OEM (from memory  _SMSTSMedia =
    OEMMedia)
    in this group run the command bcdboot C:\Windows /s F: /f ALL where f: is the drive letter assigned to the system disk, then run another step that removes the drive letter and reboots. The deploy task will now continue and you will be booting to the system
    partition.
    So I wanted to get back to working on this issue.  I noticed that when I said it Worked that it was actually still booting from C drive instead of the reserved partition.  For the past few days I have been trying to get the prestaged to work like
    a network deploy but fail every time.  I cannot get the prestaged to boot from any other partition other then the partition where windows was imaged too.
    So where I am at today.  When I do as suggest above the D drive (The reserved Boot volume) return on reboot. it will not stay hidden.  also the OS is till booting from C and does not change to the D drive or no drive letter drive with the above
    commands.  I think there is some other command missing that tells it to boot from a new location that is not bcdboot.
    Has anyone seen any guides for how to use prestaged and bitlocker enabled task sequence?  I think that would help me figure out my current issues as with bitlocker you must have this other partition.

Maybe you are looking for