1

Here's what I did:

  1. I setup nginx with my ssl certificate/key, and everything worked well. I got the secured connection I wanted.
  2. During some other installation process, I had to get back to plain http without the certificates.
  3. I switched back to ssl again.

Now what is happening is; if I use a fresh new PC (or even a new browser) I can get into the website without any problems, the certificate is valid and recognized on all browsers.

However, on my workstation, I cannot, I guess because I entered it from Chrome previously (after step 1). Installed Firefox, and I am not getting the error as well. Repeated the steps 2 and 3 and Firefox stated to give the very same error.

All SSL certificate checkers show a valid SSL status of the website.

I would appreciate any help on this. Thanks!

|improve this question
  • Is your server sending any HPKP (en.wikipedia.org/wiki/HTTP_Public_Key_Pinning) headers? And you've checked it with ssllabs.com? – Jason Martin Jan 29 '17 at 0:19
  • @JasonMartin I have just checked. Yes and yes. It looks like it is sending a SHA 256 pin. – Hasan Can Saral Jan 29 '17 at 12:31
  • Is it the correct pin for your server? That could account for first-view-works followed by an error. – Jason Martin Jan 30 '17 at 3:59
  • It is correct, I am afraid. – Hasan Can Saral Jan 30 '17 at 13:55
  • Can you say what the url is? It is hard to discern further without that. – Jason Martin Jan 30 '17 at 16:09
1

I can't make a comment since this is a new account. But if you are using an StartCom SSL this may be the problem:

Mozilla and Google decided to distrust all StartCom root certificates as of 21st of October, this situation will have an impact in the upcoming release of Firefox and Chrome in January. Apple's decision announced on Nov 30th of distrusting all StartCom root certificates as of 1st of December will have an impact in their upcoming security update.

StartCom will provide an interim solution soon and will replace all the issued certificates with issuance date on or after Oct 21st in case of requested. Meanwhile StartCom is updating all systems and will generate new root CAs as requested by Mozilla to regain the trust in these browsers.

|improve this answer
  • 1
    Thanks, but I'm not using StartCom SSL. And even if I did, Mozilla and Chrome can still validate on other computers. So I think it is not related. – Hasan Can Saral Jan 29 '17 at 1:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.