The root cause of my problem is not known to me, whatever it is, I experience frequent DNS failures. When it happens I cannot browse to my Gmail inbox. I use two DNS settings. One is the public DNS server offered by OpenDNS, and the other is Google's free DNS server. When this happens I switch from the active setting to the other one and the problem goes away. But there is a side effect to this. When browsing to Gmail fails to load, after switching the DNS I receive an error saying the security certificate the site uses is only valid for OpenDNS.

This my wild guess at what is going on:

  1. OpenDNS fails to resolve mail.google.com to its IP,
  2. My ISP sends me a page showing search results for 'mail.google.com'
  3. Since I have received some sort of page instead of a timeout, the browser, mistakenly, binds the certificate it has cached for 'mail.google.com' to the new domain. This search page is not served by https so not exception is thrown by the wrong binding
  4. After switching the DNS, the domain is correctly resolved to Gmail server's IP and since his is on https the handshake is triggered.
  5. Now, because of the wrong binding, which passed quietly as no handshake was involved, I receive the error saying the certificate used by 'mail.google.com' is only good for openDNS

I don't know much about DNS, less about https and the process of establishing a secure connection. How correct is my explanation? How can I delete the wrong association and/or the certificate?

Thanks for listening.

P. S. The problem goes away by itself, but sometimes it takes several hours before Gmail works again.

migrated from serverfault.com Apr 30 '10 at 20:46

This question came from our site for system and network administrators.


For newer FF go to Options > Privacy & Security > Certificates, there is a button View Certificates...

enter image description here

For older FF, if you go to Tools > Options > Advanced, there's a button in the bottom left labeled View Certificates. This will bring up the Certificate Manager. You can delete them from there.

Options Dialog


Firefox stores its certificates in the C:\Documents and Settings\< Windows login user name>\Application Data\Mozilla\Firefox\Profiles\< profile folder > . Remember that the Application Data folder is a hidden folder. Therefore, you need to open Windows Explorer and choose Tools → Folder Options → View (tab) → Show hidden files and folders

There is file named cert8.db in the default profile folder. You can use the Certificate Database tool (certutil.exe) command line tool to delete the certificate from the database.

certutil -D -n < certificate name >

You can obtain windows binaries of certutil.exe by downloading NSS and NSPR from Mozilla.

Unzip NSS and NSPR, then copy everything from both "bin" directories and both "lib" directory into a single location. Run certutil.exe from that location and point the tool to your cert8.db file with the "-d \path\to\profile\"

Example :

certutil.exe -D -n < certificate_name > -d "C:\Documents and Settings\Username\Application Data\Mozilla\Firefox\Profiles\4abcdefg.Guest\"

More information on certutil.exe can be found in Mozilla's documentation on certutil

Hope this helps you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy