5

I have a Windows 10 computer that operates usually without an internet connection. I have an Apache server (version 2.4) that runs on that machine (ServerName localhost), and it virtually hosts various websites (e.g., www.youtube.com - I know...humor me). There are several domains, but I'll use that one as my example.

I resolve these domains to 127.0.0.1 in the %WINDIR%\system32\drivers\etc\hosts file and I can resolve/ping them just fine.

I have defined www.youtube.com as a VirtualHost in httpd.conf and I've defined it as a domain in an SSL config file, as well. A few months ago, this all worked fine, i.e., in Firefox I was able to browse http://www.youtube.com AND https://www.youtube.com just fine. For the https version of the sites, I did have to create self-signed certificates, and install them to Firefox's cert db, but it all did work.

Well now it doesn't work anymore. I'm running Firefox version 57.0.1 (32-bit). I get this error we've all seen:

Your connection is not secure

The owner of [DOMAIN] has configured their website improperly. To protect your information from being stolen, Firefox has not connected to this website.

This site uses HTTP Strict Transport Security (HSTS) to specify that Firefox may only connect to it securely. As a result, it is not possible to add an exception for this certificate.

And when I click Advanced...

[DOMAIN] uses an invalid security certificate.

The certificate is not trusted because it is self-signed.

Error code: SEC_ERROR_UNKNOWN_ISSUER

I have tried so many solutions...generating new certs, disabling Firefox's Query OCSP responder servers to confirm the current validity of certificates setting, clearing cache, starting Firefox with a new profile, deleting the cert8.db file, using the Windows trust store instead, trying to fudge with about:config and changing security.* settings, etc. but nothing has worked.

I know it is insecure what I want..but not really, b/c this computer does NOT connect to the internet, I just want to connect to my "fake" domains that my own Apache server is hosting locally.

Is this truly impossible?

FWIW, I've tried Chrome, and it doesn't work either, but I'd rather stick w/Firefox anyway.

8
  • What exactly is your question? Chrome isn't going to trust your self-signed certificates to YouTube, it is going to complain, and more than likely will flat out refuse the use of those certificates. It is done intentionally by Google. How long ago did this configuration stopped working because Google switched to secure traffic for all its services over 5 years ago. "using the Windows trust store instead" - You can't do that with Firefox.
    – Ramhound
    Dec 6, 2017 at 20:36
  • My question is "is what I am trying to do possible?". I don't remember the exact date but it was not 5 years ago. Thanks for telling me windows store won't work. I was going off of this: support.umbrella.com/hc/en-us/articles/…
    – atreyu
    Dec 6, 2017 at 21:03
  • Apparently, they added that capability. All the same, it sounds broken, to be honest. Your problem is your attempting to basically MiTM yourself. Which really only works if the certificates you want to claim to belong to the site are considered to actually valid. You are currently trying to do that with what browsers consider to be invalid certificates which means you will go through the exception warnings each time. HSTS changes things slightly but it can be done.
    – Ramhound
    Dec 6, 2017 at 21:05
  • @Ramhound If OP is overriding the browsers PKI none of that is relevant.
    – jdwolf
    Dec 6, 2017 at 21:18
  • @Ramhound, "it can be done". Precisely my thought. I know I haven't thought of everything, and I know I am going against security convention...but if it can be done, then how?
    – atreyu
    Dec 6, 2017 at 21:18

1 Answer 1

0

I don't think this will ever be feasible with a modern version of the Firefox browser.

However, using an older version of FirefoxPortable (51.0.1) I am able to serve up secure sites using self-signed certificates. As this is a stand-alone computer (no internet connection), I am not concerned about the security implications and am satisfied with the solution. Thanks all for the input.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .