14

I've seen some similar issues strewn throughout Google's results about this, but none seem to be corporate-specific.

I continually get the 'This connection is untrusted' screen every time I attempt to log into a secure site...for instance Gmail.

This is pretty annoying as sometimes I have to go through the process of adding the exception two or three times before it finally lets me into Gmail.

I am behind a corporate firewall, going through an internal proxy server to get to the Internet, so there is no possibility for me to update the firewall...etc.

Does anybody know a way around this? Can it simply be disabled (and is that safe)?

EDIT

I'm going to reopen this question with a bit of new information.

I have been using Google Chrome lately until today, and one thing that I noticed was that I never had this issue when using either Chrome or Internet Explorer. Is there something that these other browsers do that I need to manually do in FF?

Improve this question

7 Answers 7

Reset to default
18

If your system date or time is not wrong, and your problem is still not resolved, try the following. Because this problem is occurring only in your Firefox, but not IE, navigate to the secure site in IE, and determine which certificate is being used, which will be an icon somewhere around the menu bar. Then go to IE > Tools > Internet options > Content > Certificates > Trusted root certificate authorities (or maybe Intermediate certificate authorities), and find the certificate. When you find it, select Export, to export the certificate, in the default format.

Now go to Firefox > Tools > Options > Advanced > Encryption > View certifications > Authorities, and look for a certificate(s) with a similar name. If you find one, press Export, to export a backup copy of it. Now import into Firefox Authorities the certificate you exported from IE. Exit and restart Firefox. See if the "untrusted connection" problem is now fixed. If not, you could delete the imported certificate, if you wish. If problems arise, import back into Firefox Authorities the original Firefox certificate you backed up.

As soon as you finish, and everything is working OK, delete the certificates you exported, because they must be kept secure and must not be kept as files on your computer.

Improve this answer
6
  • 1
    This worked for me too. Exported four "Certificate Authorities" which were under my company's name in IE. Used PKCS#7 format. Then in Firefox went to the Authorities page and imported all four. When importing, checked three boxes allowing all permissions for those certificate authorities.
    – stone
    Jun 5, 2012 at 18:20
  • FYI - This solution works for the new PolyBrowser
    – ganders
    Jan 8, 2015 at 14:08
  • 1
    From @User61893: Make sure you check for sub-certificates when you navigate to the secure site in IE, and determine which certificate is being used: 1) Click the padlock in the address bar to view the certificate being used. 2) Click 'view certificates' in the bubble that appears. 3) Open the 'certificate path' tab. 4) Check for sub-certificates under the original certificate and before the secure site. I needed to install all the sub-certificates as well, for Firefox to work.
    – fixer1234
    Jun 9, 2015 at 1:56
  • 1
    This was the exact solution for us - the internal corporate SSL proxy added the internal certificate chain for IE and Chrome, but they did not add it to FF. Maybe FF has it's own certificate store - whereas Chrome/IE are shared. We didn't have to restart FF to see the effect. The sec_error_unknown_issuer was driving me nuts because the authority wasn't listed in FF.
    – SliverNinja - MSFT
    Jul 27, 2015 at 13:52
  • "which will be an icon somewhere around the menu bar" that just shows the Avast virus scanner's MITM certificate, not the company's MITM certificate.
    – endolith
    Sep 21, 2015 at 14:14
7

Chances are good that the reason it's untrusted is that the proxy is acting as a man in the middle, substituting its own ssl certificate to your browser. Firefox doesn't recognize the signing authority so it prompts you whether to trust it or not.

The question then becomes: do you trust your companies IT dept? Because they would then be able to read your mail, see your purchases, credit card info, etc. Whatever you do online that is encrypted is not encrypted to them.

Improve this answer
1
  • even if you trust them not to read your mail, do you trust them to keep your unencrypted information safe from hackers?
    – endolith
    Sep 21, 2015 at 14:06
3

Probably your company's proxy is doing a Man-in-the-middle attack to all connections (though it's not really an attack in this case). FF can't tell the difference between your company proxy and EVIL_GUY_ON_THE_INTERNET doing it, so it rightfully warns you.

If this is the case, your browser is misconfigured: The certificate which your company proxy uses needs to be installed into your browser; then FF will no longer complain. As a bonus, if a MITM attack occurs inside your network (between you and the proxy), you'll still get the right warning.

As to disabling the warning: I believe it's possible, but fairly complicated. Disabling is not safe because then all encrypted connections become vulnerable to MITM attacks. The solution I outlined above preserves security (as far as possible).

Improve this answer
5
  • question #2 then...is it possible to find (via firefox) where this cert. is located?
    – erik
    Mar 4, 2010 at 14:35
  • @espais: No, not that I'm aware of. You'd need to ask your sysadmin (who should have configured your browser correctly in the first place).
    – sleske
    Mar 4, 2010 at 14:59
  • damn, i installed FF on my own in order to avoid using IE...thanks for the responses everybody!
    – erik
    Mar 5, 2010 at 14:26
  • What if a real MITM attack occurs outside the network, or a site gets hijacked and uses bogus certificates? Will your browser think it's legitimate because it accepts the company's certificate?
    – endolith
    Sep 21, 2015 at 14:04
  • @endolith: That sounds like a new question. Why not ask it as such?
    – sleske
    Sep 21, 2015 at 15:02
1

Perhaps this is occurring because your system date or time is wrong. Enter Start > Run > cmd > date /T, to check your system date. Enter time /T, to check your system time. To set system date or time, the command is date, and time. Also, ensure your clock is in the correct local time zone; and ensure it is synchronized with internet time server time.nist.gov.

Improve this answer
1

If you're behind a corporate firewall, are you using a proxy server? Some web proxy servers will break SSL authentication because they are trying to proxy SSL connections, which won't work by design.

Check your proxy settings. If possible, turn the proxy off, and browse direct.

Improve this answer
1

I solved exporting some certificates from IE and Maxton, then importing them to Firefox and restarting. I dont know why, that's the only way I could solve this problem after the automatic Firefox update to version 33.

Improve this answer
-1

I use FF3.5.5 and I get the message This connection is untrusted on https connection
every time after closing FF and deleting all cookies. FF eliminates all certificates and exception while deleting all cookies. Someone thought that was a good idea. Must have been an english geek.

Improve this answer
1
  • 1
    That isn't what Firefox does. Deleting cookies gets rid of cookies, not your cert store. I guess it might get rid of temporary exceptions as well.
    – Rory Alsop
    Dec 13, 2010 at 12:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .