0

Reposted from ServerFault as they pointed me to this site for this question.

I have a local development site with virtual host gpd.local that uses https by default.

Up untill recently I could access the local site through https both firefox and chrome. But a couple of days ago I cannot. I get the message that the site uses an invalid ssl certificate (precisely translated from greek in firefox: "Failure to secure connection. Page failed to certify its identity", on chrome it displays: ERR_CONNECTION_RESET after clearing chrome cache I get the NET::ERR_CERT_AUTHORITY_INVALID error message). And there is NO option to add an exception (nor firefox nor chrome) as it used to be.

I use XAMPP 7.2.3 on windows 7 and I use the default apache ssl certificate that comes with XAMPP (I think it is for example.com, but it used to work fine by adding exception).

I use firefox v64 on windows and chrome v71.0.3578.98 on windows.

As you can see in the screenshot below the exception is indeed present in firefox (it is in greek)

ff certificates

The columns are:

  1. Certificate Name=Unknown(not stored)
  2. Server = gpd.local:443
  3. Lifespan: Permanent
  4. Expires: [blank]

What can I do to fix this?

UPDATE:

Yes, the local site should work with https. It is a must and it is how it will work on a live server so the dev mirror should use same as well. So the option to not use https is not one I can follow. It is a requirement.

Ideally I would like it to work as it did work so far. Meaning by using a default certificate and adding exceptions per local site.

Specificaly I do not want to disable ssl checking globally on the browser and I would prefer not having to create new certificates one for each local site.

Setting Apache headers is a possible solution but so far I cannot get it to work. But if no other way is found I can try creating new certificates as well with proper instructions.

UPDATE2: I have another mirror dev site locally using SSL and HTTPS using an older version of Apache (older XAMPP Version 1.8.0) and it works fine no SSL errors and it still uses a default certificate that comes with apache installation. So I wonder if this has anything to do with newer version of apache (newer version of XAMPP) and how to resolve. Maybe some setting in Apache??

Help is greatly appreciated

5
  • What is the exact error you receive? Dec 18, 2018 at 14:59
  • @Appleoddity, in firefox it says Failure to secure connection (it is in greek I translate) and it says the page cannot certify its identity. It is strange because it used to work fine a couple of days ago with exact same settings. I dont get a specific ERR_whatever code in the page
    – Nikos M.
    Dec 18, 2018 at 15:01
  • @Appleoddity on chrome it says : ERR_CONNECTION_RESET
    – Nikos M.
    Dec 18, 2018 at 15:07
  • @Appleoddity after clearing chrome cache I get the NET::ERR_CERT_AUTHORITY_INVALID error message no option to add exception
    – Nikos M.
    Dec 18, 2018 at 15:14
  • On chrome there is an option to add the certificate under "root certificates" or sth like that. But why was it working before and how can I do same for firefox?
    – Nikos M.
    Dec 18, 2018 at 15:20

2 Answers 2

0

I'm not an expert on this, but my research tells me that the problem is that you are using the default Apache certificate but you are browsing to a URL like mysite.dev. Because the default certificate in Apache does not include mysite.dev in it's Common Name or in it's Subject Alternative Name and/or the certificate is not signed by a trusted authority, the browser rejects it.

There are two possibilities here. Your Apache web server may be including HSTS headers which tell the browser to enforce HTTPS security. Or, the browsers may be rejecting the SSL certificate because it is a default cert / or it does not include the domain names you are trying to access.

In either case, I found an excellent post over at ServerFault that tells how to create a new self-signed certificate with a subject alternative name and CN that matches the domain(s) you are trying to use, how to install it in Apache, and alternately how to disable HSTS headers in Apache so the browser's give you the option to "proceed" as before.

https://serverfault.com/a/867838/425565

4
  • I will check it out and let you know. Meanwhile it is odd because it used to work fine a couple of days ago. Maybe latest updates of browsers changed this. But ideally I am looking for a generic solution to have for all my dev sites that I run locally for development purposes instead of having to create and import new certificates for each one I make.
    – Nikos M.
    Dec 18, 2018 at 15:32
  • @Nikos Try to adjust the HSTS headers in Apache so that the browser allows you to use an untrusted SSL certificate. Also, consider not using HTTPS for local development sites unless absolutely necessary. That's a lot of extra trouble... Dec 18, 2018 at 15:34
  • Yes this is what I am checking right now.. I will let you know
    – Nikos M.
    Dec 18, 2018 at 15:35
  • unfortunately I cannot get the apache headers to work (mod_headers.so is loaded). I added them both on :80 virtual host and :443 virtual host (first only on :80 virtual host). Still get same issue. If you have an idea on how to work please update your answer
    – Nikos M.
    Dec 18, 2018 at 15:47
0

Rather than use individual checkboxes, Firefox now operates over a range of SSL/TLS protocols. These settings are accessed using the about:config preferences editor.

Lowest Acceptable Protocol: security.tls.version.min (default SSL3.0 = 0)

Highest Allowed Protocol: security.tls.version.max (default TLS1.0 = 1)

To modify:

(1) In a new tab, type or paste about:config in the address bar and press Enter. Click the button promising to be careful.

(2) In the Search box above the list, type or paste tls and pause while the list is filtered

(3) To disable SSL3 and requires TLS of one flavor or another, double-click security.tls.version.min and enter the desired value:

0 = SSL 3.0 okay 1 = at least TLS 1.0 2 = at least TLS 1.1 See WARNING below (4) To disable TLS of one flavor or another, double-click security.tls.version.max and enter the desired value:

0 = up to SSL 3.0 1 = up to TLS 1.0 2 = up to TLS 1.1 See WARNING below WARNING: According the following article, selecting TLS 1.1 may prevent connections to older servers from working: http://kb.mozillazine.org/Security.tls.version.*

1
  • Thanks but I dont want to deisable ssl or tls on firefox because this will disable for all sites. rather and ideally I want to add an exception only for the local sites that I have and these without having to create new certificates for each one. In other words as it used to work so far. Setting apache headers maybe an option but I cannot get it to work. Else I might try sth else but under no case will I disable ssl on firefox or chrome
    – Nikos M.
    Dec 19, 2018 at 10:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .