Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

My situation is the following: in our corporate network a special kind of SSL certificate issued by the company itself is used. Every time I open a site via https in Firefox a warning monit is displayed saying "sec_error_unknown_issuer". In certificate details it says that this particular certificate was issued by my company, there is a company address and name and everything. It's very annoying because I need to add an exception for the invalid certificate every single time I go to an SSL encrypted site. One possible solution would be to give up SSL and use plain http when possible (there is no difference between SSL and no-SSL at the moment if the network admins handle the certificates themselves I guess) but some sites do not work without SSL, such as bank login pages. So I think the better idea would be to add the certificate to Firefox list of trusted authorities. To do this, I need to have an authority certificate. I tried to get it with the following Openssl command but to no avail:

openssl s_client -connect hostname:port

It shows one certificate but and then it stops because some certificates could not be verified and the certificate is incorrect because Firefox display an error when I try to import it. I don't remember the exact message now but it was something like "this certificate is not valid authority certificate".

I also tried to use Wireshark but can't use too good and I failed to grab what I was looking for. And as the last resort, it's impossible to disable SSL certificates validation in Firefox.

So how can I grab this local authority certificate that I could import to Firefox and stop being annoyed by the error messages?

share|improve this question
    
IIRC It is up to your admins to place the company certificate in the list of trusted certs in all their employees systems. Ask them to do the job. –  Jan Doggen Jun 13 '13 at 11:53
    
Yes, that would be the best but I don't think it will happen. There are both Windows and different varieties of Linux in use here. If they wanted to do this, they would but they will say that it doesn't pay. –  user1042840 Jun 13 '13 at 11:57

2 Answers 2

Add the -showcerts option to make s_client print the entire chain.

share|improve this answer
    
I tried this option but too Openssl just showed the first certificate between "BEGIN CERTIFICATE" and "END CERTIFICATE" that belongs to the remote site such as google.com I think and after that something about connection failure because issuer could not be verified (damm, I should keep the exact error messages with me). When I save this certificate to a file "cert.crt" and tried to import to fx trusted authorities list I got an error that it's not a correct authority certificate. I think it didn't print the certificate I am interested in. –  user1042840 Jun 13 '13 at 12:52

I am facing the same problem today, and every time I try to connect a site, all mozilla products ask for permission to add certificate. And that certificate only certifies for the specified website.

In order to add your corporate certificate into the trusted authorities, go to Control Panel -> Internet Options -> Content -> Certificates -> Trusted Root Certification Authorities

And a list appears there. Find your corporate certificate, and export it to a file, with wizard's default options.

After that open firefox, Options -> Advanced -> View Certificates -> Authorities -> Import

Select the file that you have exported, and check all the trust options.

Now you will be able to connect all the websites.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.