Why does Firefox 32 suddenly not recognize a certificate?
Firefox 32 says that https://rcmail.secure.ne.jp/rcmail-05/ is untrusted: rcmail.secure.ne.jp uses an invalid security certificate. The certificate is not trusted because the issuer certificate is unknown. (Error code: sec_error_unknown_issuer)
Website Identity Website: rcmail.secure.ne.jp Owner: This website does not supply ownership information. Verified by: Not specified
Privacy & History Have I visited this website prior to today? Yes, 114 times
Firefox 31 displayed the site just fine before today.
Internet Explorer 10 says everything is still trusted today:
SECOM Trust Systems CO LTD
Servision Certification Authority
rcmail.secure.ne.jp
SECOM's certificate is issued by http://www.valicert.com/ and valid from 1999 to 2019. Servision's certificate is also issued by http://www.valicert.com/ and valid from 2007 to 2017. rcmail.secure.ne.jp's certificate is issued by Servision and valid from 2014.01.08 to 2015.01.16.
פתרון נבחר
hello n0diamond, mozilla removed support for root certificates with RSA key sizes smaller than 2048 bits for security reasons, SECOM was one of them.
https://wiki.mozilla.org/CA:MD5and1024 https://developer.mozilla.org/en-US/Firefox/Releases/32/Site_Compatibility#Security
Read this answer in context 👍 0כל התגובות (5)
Firefox doesn't come with the "Servision Certification Authority" root certificate. If IE has it then export the certificate in IE and import the certificate in the Firefox Certificate Manager. To make it work as a root certificate you need to set the appropriate trust bits when prompted.
השתנתה ב־ על־ידי cor-el
Isn't the root SECOM rather than Servision?
Why would Firefox 31 have displayed the page 114 times without a peep?
Both IE and Firefox have SECOM's root certificate. Neither IE nor Firefox has a Servision certificate, at least not that I can find, among roots and intermediates and trusted. I think IE trusts Servision's certificate from SECOM's root, and Firefox 31 used to do the same.
פתרון נבחר
hello n0diamond, mozilla removed support for root certificates with RSA key sizes smaller than 2048 bits for security reasons, SECOM was one of them.
https://wiki.mozilla.org/CA:MD5and1024 https://developer.mozilla.org/en-US/Firefox/Releases/32/Site_Compatibility#Security
I see, Internet Explorer 10 has two root certificates for SECOM. One is in SECOM's own name and is 2048 bits. One is in the name of www.valicert.com but has SECOM's name associated in some manner, and is only 1024 bits, so that's the one that was removed in Firefox 32. Servision and rcmail.secure.ne.jp need to be informed to switch to SECOM's newer certificate.