Sites With Expired Certificates Are Completely Inaccessible Using Firefox

[2K20CT6]

Firefox 101.0.1 (64-bit) will not allow secure access to sites with expired security certificates, period. I understand the need for security vigilance but with no exceptions allowed this seems to be a browser overreach. Expired security certificate warnings are certainly prudent, but a denial of access with no exceptions is not only frustrating it can be costly when time-sensitive financial or legal matters are involved. You must notify the site admin, then wait for an updated certificate to materialize. This never happens quickly enough and until it does the only viable alternative is to use another browser such as Microsoft Edge, which warns of an expired certificate but allows you to ignore it and continue to the site.

Thoughts?

[jscher2000]

Usually, Firefox would show an "Advanced" button that provides the option to make an exception. However, there probably are cases where Firefox won't allow an exception, such as sites that Firefox knows require "strict transport security" (HSTS). Is that the explanation for the site you are trying to reach?

[2K20CT6]

Yes, that was the explanation. See the attached screenshot. The browser only knows the status of the security certificate, not the risk (if any) of continuing. I contend that the decision to continue should be mine, not the browser's. 

[jscher2000 · Accepted solution]

HSTS is the website's policy, not Firefox's.

Firefox has two sources of HSTS information:

(1) Predefined list. If Edge lets you connect, the site probably isn't on this list since Firefox uses a list from Chrome/Chromium which presumably is inherited by Edge.

(2) Stored instructions. If you visited the site on an HTTPS connection previously and the site instructed Firefox to apply HSTS on all visits, this is stored in a file named SiteSecurityServiceState.txt in your profile folder. In case of emergency, you could edit or delete that file and Firefox will rebuild the list as you browse. I wouldn't do that if the site handles sensitive information.

[2K20CT6]

Very helpful information - thanx!

[atkxyz]

I am sorry i do not remember the details very specifically, but i had left a pinned tab of ajio.com, logged in, and then did some browsing on vpn (softether). When say after a day i returned to the ajio.com, firefox would not let me access the site - some certificate issue - denied access. i tried the suggested profile deletion, even re-installing (which is usually followed by refresh option, but only once for a short while after re-installing (no refresh) was i able to access the site. but then later that stopped and even repeated reinstalls did not help. all the time i was able to access the site and account on edge.

firefox is supposed to be a very secure browser, but the fact that some certificate installation took place from external source, which prevented me to access site, was remarkable and it had me worried about access to my system from outside.

i hope my being old and not IT person, my recollection and impressions were wrong - but still i thought i would share the memory and reluctance to install firefox again for a while at least.

wondering if admin at ajio.com thought that source of my connection having changed from one country to another was a source of insecurity and acted in defense only. still.

thanks

[jscher2000]

---

@atkxyz wrote:

... after a day i returned to the ajio.com, firefox would not let me access the site - some certificate issue - denied access.

---

When Firefox is refusing to connect, there usually is an Advanced button you can click for more specific details on the problem. For reference, this article lists the various SEC_ERROR codes:

https://support.mozilla.org/kb/error-codes-secure-websites

You mentioned denied access, which sounds similar to "Access Denied". That's an error users report seeing pretty often, and I saw just the other day when one of my content blockers triggered a site to hate me for a while. Here's more info on that:

The "Access Denied" message with a Reference # is characteristic of a perimeter security system/Web Application Firewall designed to prevent bot and other suspicious connections to the website.

Some possible issues to consider:

(A) If you are using a VPN when accessing these sites, try without the VPN.

When you are using a VPN, your IP address is from a remote system used by many strangers. So if that IP address is temporarily banned due to someone else's activity, that also will affect you. If you need the VPN, try selecting a different server or exit node in your VPN software.

In your scenario of the problem happening after switching from VPN back to local, it's possible the site had stored the other IP address in a cookie, so now there was a suspicious mismatch. To clear the cookies for a single site, you can use the "Manage Data" button on the Settings page (it's in the Cookies and Site Data section of the Privacy & Security panel).

(B) If you have customized any privacy preferences that affect browser requests -- for example, modifying your "user agent" or referring site header -- you may need to undo those changes

Also, some add-ons may modify headers in a way that looks suspicious to these systems. Can you think of any add-ons you use that might make privacy-related tweaks to your requests?

(Note: some of your add-ons might only run in regular windows, not private windows, so if you noticed a difference, that could be a clue.)

(C) If you have Firefox set not to accept ANY cookies, that also could be a problem for some sites

(D) Maybe your requests are modified by an intermediary (such as a proxy server, your security software, or an interloper)

Although most people are not intentionally using a proxy server, Firefox may discover one set up in your system settings. Sometimes forcing Firefox to ignore those settings helps with weird connection issues. Here's how:

Open the Settings page using either:

* "3-bar" menu button > Settings
* (menu bar) Tools > Settings
* type or paste about:preferences into the address bar and press Enter/Return to load it

In the very tiny search box at the top of the page, type proxy and Firefox should filter to the "Network Settings" section of the page.

Click the Settings button, change the top setting to "No Proxy" and then click the OK button at the bottom of the dialog to save your change.

Any difference?

[JohnP]

I agree with the comment about over-reach by Mozilla Firefox. Now I find several pf my subscriptions are not accessible without going through a gyration process of special acceptance of the site connection. Very time-consuming. A simple warning would be sufficient to allow the connection.

[jscher2000]

---

@JohnP wrote:

I find several pf my subscriptions are not accessible without going through a gyration process of special acceptance of the site connection. Very time-consuming. A simple warning would be sufficient to allow the connection.

---

A gyration process... normally if a certificate expired and the site doesn't force Strict Transport Security, you could click an Advanced... button and that provides access to the exception button. Is that what you see, or something different?

If you aren't sure why Firefox is flagging up a connection issue, I suggest investigating that in more detail before simply accepting an insecure connection. You can copy/paste the text from the error page into a new question on the Mozilla Support site. They have a team of support volunteers to troubleshoot malfunctions with your currently installed version of Firefox, while this site is focused on idea submissions for future versions of Firefox (looking ahead anywhere from 8 weeks to many months). Here's a link to the new question form (for Windows/Mac/Linux): https://mzl.la/3y1vQUQ