3

For our corporate network we use an internal CA, which directly signs some intranet server certificates. Now the root certificate is about to expire. I tried to renew it with the following OpenSSL command:

openssl req -new -x509 -days 123 -key root.key -out root.crt

I deleted the old certificate from my PC and installed the new one. Windows/IE, Chrome, and Opera seem to be fine with it, but Firefox won't accept it. Trying to access an intranet server gives me the sec_error_unknown_issuer error, stating that no chain is provided. I googled my fingers to the bone, but the only answer I could find was that that the intermediate certificate is missing from the server config. But in my case there is no intermediate CA!! Why can't Firefox link the server certificate to the new root? All the other browsers seem to be able to and even openssl verify says everything is OK. Any ideas?

2 Answers 2

2

I figured it out! The problem was my openssl.cnf. The old certificate was created with string_mask = utf8only. This line was missing from my current file, resulting in a default value of PrintableString, T61String, BMPString. I did not use any non-ASCII characters, but it seems it was still enough to irritate Firefox.

1
  • Well done! That sounds like a difficult issue to track down. You should probably accept this (your own) answer to let others know the question has a definitive solution -- and to help anyone else with this issue to find your answer. Apr 28, 2015 at 9:08
1

I deleted the old certificate from my PC and installed the new one.

Firefox uses its own separate certificate store. At the risk of stating the obvious (for those of us who regularly use Firefox), did you add the new CA certificate to Firefox itself?

2
  • Yes, I did install/replace it twice, in Firefox and in Windows via Install Certificate and restarted Firefox/the PC--just as I did when I installed the original certificate years ago. Apr 27, 2015 at 8:43
  • 1
    @user2323470 What happens when you open the CA certificate in Firefox? Apr 27, 2015 at 9:04

Not the answer you're looking for? Browse other questions tagged .