Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm trying to access my (European Parliament) Webmail from a Linux/Firefox machine at the following address and I get security warning messages explaining that the identity of the site cannot be verified (the error message is in french).

But this only happens with Linux/Firefox from one machine.

Here's the address:

https://webmail.europarl.europa.eu/

(and I'm trying to access it from my home, not from the EP).

And here's the detailed error message:

webmail.europarl.europa.eu utilise un certificat de sécurité invalide.

Le certificat n'est pas sûr car l'autorité délivrant le certificat est inconnue.

(Code d'erreur : sec_error_unknown_issuer)

French to English translation

webmail.europarl.europa.eu uses an invalid security certificate.

The certificate is not trusted because the authority issuing the certificate is unknown.

(Error code: SEC_ERROR_UNKNOWN_ISSUER)

So basically, if I translate, it is telling that the webmail.europarl.europa.eu certificate is invalid because the authority that delivered the certificate is unknown. I do only get this invalid certificate thing on Linux/Firefox.

From a MacBookPro running Safari, I go to what looks like the correct webmail login page.

From the same Linux machine, but using another user account and Chrome instead of Firefox, I go to what looks like the correct webmail login page.

So there are several possibilities, here are a few ones:

  1. Firefox is right and my Linux box has been hacked
  2. Firefox is right and detecting something that neither Chrome nor Safari is detecting (like, say, my router that may be hacked)
  3. Safari on the MacBook Pro and Chrome on Linux are both correct and it is just Firefox on Linux that is wrongly stressing me when everything is normal.

How do I know which one of these possibilities (or any other) is correct?

How can I troubleshoot what is going on with either Linux/Firefox or with the parliament's webmail?

share|improve this question

1 Answer 1

up vote 3 down vote accepted

Not exactly #3, but close.


https://webmail.europarl.europa.eu/ uses a SSL certificate issued by GlobalSign, which Mozilla does include as a trusted certificate authority.

However,

  • the certificate is signed not by GlobalSign Root CA directly, but by GlobalSign Domain Validation CA, which in turn is signed by Root CA;
  • the webmail.europarl.europa.eu server is misconfigured and only sends its own cert, instead of the complete certificate chain;
  • Mozilla does not have the intermediate CA cert, only the root CA.

Because of this, Firefox does not have enough information to verify your webmail server's certificate.

Other software does include both GlobalSign Root and GlobalSign Domain Validation certificates, so it is able to build the certificate chain on its own. (I checked Windows XP and the Opera browser; I don't have access to a Mac OS X system nor can install Chrome on Linux right now.)


You can:

  • nag the server's administrator to fix the certificate chain;

  • install the GlobalSign Domain Validation intermediate CA certificate into Firefox;

    • copy the textarea contents into a file named similar to GlobalSign Domain Validation.crt

    • Firefox - Tools - Options - Advanced - Encryption - View certificates - Authorities - Import

  • add an exception in Firefox for the webmail site.

    SHA-1 fingerprint for the current certificate of https://webmail.europarl.europa.eu/, as seen from my end:

    0e c3 96 ba 12 94 ea 15 96 fc 28 2a d4 d4 12 2a 6b 79 a5 7a
    
share|improve this answer
    
+1 thanks a lot for the detailed info! This is a great answer/explanation. I'll install the certificate into my Firefox and check the SHA-1 you sent me. Thanks :) –  Weezy Dec 23 '10 at 8:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.