0

since a few days i get the following error whenever i try to open a HTTPS webpage in Firefox 52.0.1 "Fehler: Gesicherte Verbindung fehlgeschlagen" ("error: sucure connetcion failure" or so) and "An error occurred during a connection to www.blah.com. security library: memory allocation failure. Error code: SEC_ERROR_NO_MEMORY". I'm on a machine running Leap 42.2 OpenSuse Linux.

I guess this error occurred first when I had firefox updated from 51.x.

Measures taken so far that did not help:

  • Getting back to version 51.X.
  • Uninstalling and instaling versions 52.0.1.
  • Uninstalling all extensions in firefox.
  • Changing security.tls.version.min and security.tls.version.max in about:config
  • Checking all entries dealing with "https" in about:config and toggling some.
  • deleting files cert8.db and secmod.db
  • check if glib-networking library is installed

It may however be the system, not the browser: Chromium as well prevents connection to some few https resources but does not seem to be as strict as firefox.

When the problem apeared for the first time I had played arround with gpg and KGpg, so that might have caused the problem. Deactivating all keys I have on my system did not solve the problem.

I know, firefox as of version 52 handels invalid https certificates in a stricter way, but it cant be that strict. Even www.mozilla.org does not work. There must be some other issues.

A firefox 52.0.1 installation on an other computer I have works okay so it does not seem to be the network.

Does anybody have an idea what might cause this strange behavior.

cheers!

3
  • You can always edit your own questions. Please add any and all information to your question. Information in comments isn’t very visible.
    – Daniel B
    Apr 13, 2017 at 13:00
  • Have you tried 52.0.2?
    – DavidPostill
    Apr 13, 2017 at 16:09
  • not yet. its not yet in the distros packages.
    – sagemol
    Apr 14, 2017 at 9:38

1 Answer 1

0

I had this problem with Firefox. It turns out that (according to ssllabs.com, my browser supports only the following EC curves: x25519, secp256r1, secp384r1, secp521r1.

The certificate I had generated (as inspected by OpenSSL) uses a different curve:

    Subject Public Key Info:
        Public Key Algorithm: id-ecPublicKey
            Public-Key: (570 bit)
            pub: 
                04:[...]
            ASN1 OID: sect571k1

Notice the curve name above: sect571k1

I had created my certificate using Java's keytool and evidently is supports more curves than my browser. Firefox seems to have no complaints when importing the certificate. It seems like "curve not supported" would have been an easy error message to provide to users.

Changing the certificate to use a browser-supported curve fixed things for me.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .