Firefox 表示证书不受信任，即使证书链良好

Question

HTTPS https://www.bigfont.ca适用于 Chrome、Internet Explorer 和 Safari，但不适用于 Firefox。它还通过了 this SSL Checkers 处的所有测试。 。火狐浏览器说:

An error occurred during a connection to www.bigfont.ca. Peer's certificate has been marked as not trusted by the user. (Error code: sec_error_untrusted_cert)

这是 Firefox 的已知情况。我们查看了StartSSL FAQ建议是:

You must add the intermediate CA certificate to your installation.

我们正在使用 SmartSSL 和 OpenSSL 创建 SSL 证书。因此，我们按照 Troy Hunt's tutorial 添加了中间 CA 证书并运行此命令来创建 PFX。

OpenSSL> pkcs12 -export -in bigfont.ca.crt -inkey bigfont.ca-encrypted.key 
-certfile sub.class1.server.ca.pem -out bigfont.ca.pfx -password pass:my-password

我们将生成的 bigfont.ca.pfx 文件上传到 Azure 网站的配置页面。

为了进一步测试，我们运行了openssl s_client -servername www.bigfont.ca -connect www.bigfont.ca:443 -showcerts。结果表明证书链运行良好。

depth=1 C = IL, 
O = StartCom Ltd., 
OU = Secure Digital Certificate Signing, 
CN = StartCom Class 1 Primary Intermediate Server CA

verify error:num=20:unable to get local issuer certificate
verify return:0

---
Certificate chain

 0 s:
      /description=T8eg9X1a04Scp3hM
      /C=CA
      /CN=www.bigfont.ca
      /<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="67020a060e0b260303150214145a140f0612090b1213130e0927050e0001080913490406" rel="noreferrer noopener nofollow">[email protected]</a>
   i:
      /C=IL
      /O=StartCom Ltd.
      /OU=Secure Digital Certificate Signing
      /CN=StartCom Class 1 Primary Intermediate Server CA

-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----

 1 s:
      /C=IL
      /O=StartCom Ltd.
      /OU=Secure Digital Certificate Signing
      /CN=StartCom Class 1 Primary Intermediate Server CA
   i:
      /C=IL
      /O=StartCom Ltd.
      /OU=Secure Digital Certificate Signing
      /CN=StartCom Certification Authority

-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
---
Server certificate
subject=
      /description=T8eg9X1a04Scp3hM
      /C=CA
      /CN=www.bigfont.ca
      /<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="f59098949c99b4919187908686c8869d94809b998081819c9bb5979c92939a9b81db9694" rel="noreferrer noopener nofollow">[email protected]</a>
issuer=
      /C=IL
      /O=StartCom Ltd.
      /OU=Secure Digital Certificate Signing
      /CN=StartCom Class 1 Primary Intermediate Server CA

---
No client certificate CA names sent

---
SSL handshake has read 3369 bytes and written 547 bytes

---
New, TLSv1/SSLv3, Cipher is RC4-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1
    Cipher    : RC4-SHA
    Session-ID: 6E1F00009...FDD7B7BF7B7
    Session-ID-ctx:
    Master-Key: 2FA3C020A506198C1319081F9E023D35...5AEB01985323AADCF9
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    Start Time: 1413947020
    Timeout   : 300 (sec)
    Verify return code: 20 (unable to get local issuer certificate) 

---
read:errno=10054

如果该链正常工作，为什么 Firefox 会提示？

Answer 1

解决方案

<强> Reset Firefox to its default state 。

1. 火狐浏览器
2. 帮助
3. 问题排查信息
4. 重置 Firefox

详细信息

事实证明，该问题与存储 Firefox 证书的 cert8.db 文件有关。在这里找到它:

1. 火狐浏览器
2. 帮助
3. 问题排查信息
4. 应用基础知识
5. 配置文件文件夹
6. 显示文件夹

问题可能是我们搞乱了 Firefox 的 StartCom 的权威证书。我们可能在恢复 StartSSL 客户端身份验证证书的过程中遇到了麻烦。

您的证书(客户端身份验证)

当局

我们可能不小心搞乱了这些，从而使 Firefox 不信任 StartCom。