0

I am checking my Firefox 'Certificate Manager' - I am unable to find this Google Certificate:

serial#: ‎     01 00 21 25 88 b0 fa 59 a7 77 ef 05 7b 66 27 df
issuer:       CN = GeoTrust Global CA/O = GeoTrust Inc./C = US
subject:      CN = Google Internet Authority G2/O = Google Inc/C = US

If I try and import the 'cer' file itself; Firefox says:

/!\ This certificate is already installed as a certificate Authority.

But when I scroll through the Certificate Manager; I can't see anything which has 'Google' in it.

For the 'G' list I have only:

1. Generalitat Valencia
2. GeoTrust Inc.
3. GlobalSign
4. GlobalSign nv-sa 
5. GoDaddy.com, Inc. 
6. Government Root Certificate Authority
7. GTE Corporation

So where is this Certificate hiding ? Firefox 56.0.1, Windows 7. No issues with other SSL sites (ebay, amazon, yahoo, others); no issues with google in IE, Chrome.

BACKGROUND:

Some months back - I deliberately went through my Firefox-provided CAs; and only enabled a handful of them - which I know I need. (rather than than the 70 odd that Firefox think I might need).

This worked-out just fine: I was able to 'add exception' when I found a site which wasn't already covered.

All of a sudden I am unable to connect to any Google.com (or google.co.uk), And Firefox doesn't offer me the opportunity to 'add exception' , since it says this:

Your connection is not secure

The owner of www.google.co.uk has configured their web site improperly. To protect your information from being stolen, Firefox has not connected to this web site.

This site uses HTTP Strict Transport Security (HSTS) to specify that Firefox only connect to it securely. As a result, it is not possible to add an exception for this certificate.

1

Whatever you do, don't import a certificate to your trust store just because you've found it being served by someone.

It's definitely safer to revert to the default trust store, see if it fixes the problem. Then try to clean it again.

HSTS means (also) that Firefox won't offer an exception explicitly. HSTS has been requested by that server before, at the time when you were able to connect to it securely.

0

Found it. (And also : weirdly: google just started working again - I don't know what I did : must have turned it off and on again; Firefox I mean, not Google - obviously :-) ).

It's hiding in the 'GeoTrust Inc.' section; maybe it is because it is an 'intermediate CA' or something ?

  • No, it stopped working again. Something else going on obviously....(but at least I can find the certificate in question). – monojohnny Oct 26 '17 at 9:39
  • But why doesn't Firefox let me look at the Certificate it received - very annoying. – monojohnny Oct 26 '17 at 9:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.