0

I'm using client-side SSL certificates to access my web server.

Suddenly stopped working after several months with no changes to my nginx config, but only in Firefox. Still works fine in Chromium. My nginx logs are full of these types of messages:

2015/05/14 21:35:35 [info] 25405#0: *274 client SSL certificate verify error: (20:unable to get local issuer certificate) while reading client request headers, client: 1.2.3.4, server: mail.myhost.com, request: "GET / HTTP/1.1", host: "mail.myhost.com"

Chromium version: 42.0.2311.135

Firefox version: 38.0

SSL server cert is Comodo, client cert is from Startcom.

Server certificate information is identical in the 2 browsers.

ssllabs.com gives my server SSL setup an "A", so I think it must be the client cert.

This happens even when I start Firefox in safe-mode so I think we can rule out extension/add-on interference.

Ideas?

I also cannot access the startcom panel:

startcom error

0

Have you recently updated the ca-certificates file on your server? I think there have been recent updates which removed some such certificates.

  • % pacman -Ss ca-certificates core/ca-certificates 20150402-1 [installed] Common CA certificates (default providers) core/ca-certificates-cacert 20140824-2 [installed] CAcert.org root certificates core/ca-certificates-mozilla 3.18-3 [installed] Mozilla's set of trusted CA certificates core/ca-certificates-utils 20150402-1 [installed] Common CA certificates (utilities) – g33kz0r May 15 '15 at 5:23
0

Fixed it, using comment #4 here Bug 1037080

and this FireFox access problem

It appears the problem was stale/superfluous certificates. Exact steps I took:

In Firefox Please remove all CA certificates marked with "Software Security Device" from "Advanced" -> "Encryption" -> "View Certificates", choose the "Authorities" tab. You must have imported a CA certificate from us incorrectly into your browser.

The restarted Firefox and it worked. Woohoo!

  • You should explain in the answer what the problem was. Links are for reference, they shouldn't be the only useful info. Note that the nature of the answer indicates the question was off topic (it has nothing to do with the server or server config). – AD7six May 16 '15 at 9:33
  • Better now?????? – g33kz0r May 16 '15 at 16:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.