Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.networking > #3933 > unrolled thread

While using firefox to access https://www.google.com, I meet the "Your connection is not secure" issue.

Back to article view | Back to comp.os.linux.networking

Contents

  While using firefox to access https://www.google.com, I meet the "Your connection is not secure" issue. Hongyi Zhao <hongyi.zhao@gmail.com> - 2017-01-08 23:48 +0000
    Re: While using firefox to access https://www.google.com, I meet the "Your connection is not secure" issue. Dan Purgert <dan@djph.net> - 2017-01-09 00:49 +0000
      Re: While using firefox to access https://www.google.com, I meet the "Your connection is not secure" issue. Hongyi Zhao <hongyi.zhao@gmail.com> - 2017-01-09 00:54 +0000
    Re: While using firefox to access https://www.google.com, I meet the "Your connection is not secure" issue. Richard Kettlewell <invalid@invalid.invalid> - 2017-01-09 08:59 +0000
      Re: While using firefox to access https://www.google.com, I meet the "Your connection is not secure" issue. Hongyi Zhao <hongyi.zhao@gmail.com> - 2017-01-09 11:42 +0000
        Re: While using firefox to access https://www.google.com, I meet the "Your connection is not secure" issue. Dan Purgert <dan@djph.net> - 2017-01-09 11:43 +0000
          Re: While using firefox to access https://www.google.com, I meet the "Your connection is not secure" issue. Hongyi Zhao <hongyi.zhao@gmail.com> - 2017-01-09 12:58 +0000
        Re: While using firefox to access https://www.google.com, I meet the "Your connection is not secure" issue. Richard Kettlewell <invalid@invalid.invalid> - 2017-01-09 12:00 +0000
          Re: While using firefox to access https://www.google.com, I meet the "Your connection is not secure" issue. Hongyi Zhao <hongyi.zhao@gmail.com> - 2017-01-09 13:12 +0000
            Re: While using firefox to access https://www.google.com, I meet the "Your connection is not secure" issue. Jamma Tino Schwarze <jamma-usenet@tisc.de> - 2017-01-11 17:47 +0000
              Re: While using firefox to access https://www.google.com, I meet the "Your connection is not secure" issue. Hongyi Zhao <hongyi.zhao@gmail.com> - 2017-01-12 05:27 +0000

#3933 — While using firefox to access https://www.google.com, I meet the "Your connection is not secure" issue.

Hi all,

Several days before, I've always access https://www.google.com via 
firefox.  But, these days till now, when I using firefox to access 
https://www.google.com, I meet the "Your connection is not secure" issue.

For detail, the issue is as follows:

---------------
The url used by me is https://www.google.com/ncr

The issue report are as follows:

Your connection is not secure

The owner of www.google.com has configured their website improperly. To 
protect your information from being stolen, Firefox has not connected to 
this website.

This site uses HTTP Strict Transport Security (HSTS) to specify that 
Firefox may only connect to it securely. As a result, it is not possible 
to add an exception for this certificate.

Learn more…

Report errors like this to help Mozilla identify and block malicious sites

www.google.com uses an invalid security certificate.

The certificate is only valid for the following names:
  *.twitter.com, twitter.com  

Error code: SSL_ERROR_BAD_CERT_DOMAIN

---------------

I tried many solutions found on the internet, but still cann't solve this 
issue.  Any hints for this issue?

Regards
-- 
.: Hongyi Zhao [ hongyi.zhao AT gmail.com ] Free as in Freedom :.

[toc] | [next] | [standalone]

#3934

Hongyi Zhao wrote:
> Hi all,
>
> Several days before, I've always access https://www.google.com via 
> firefox.  But, these days till now, when I using firefox to access 
> https://www.google.com, I meet the "Your connection is not secure" issue.
>
> For detail, the issue is as follows:
>
> ---------------
> The url used by me is https://www.google.com/ncr
>
> The issue report are as follows:
>
> Your connection is not secure
>
> The owner of www.google.com has configured their website improperly. To 
> protect your information from being stolen, Firefox has not connected to 
> this website.
>
> This site uses HTTP Strict Transport Security (HSTS) to specify that 
> [...]

I've seen this happen with "transparent" proxies getting in the way, or
a bad cert somewhere.  Essentially your end has cached a specific cert,
and that's the only cert you'll accept for the remote server.

-- 
|_|O|_| Registered Linux user #585947
|_|_|O| Github: https://github.com/dpurgert
|O|O|O| PGP: 05CA 9A50 3F2E 1335 4DC5  4AEE 8E11 DDF3 1279 A281

[toc] | [prev] | [next] | [standalone]

#3935

On Mon, 09 Jan 2017 00:49:56 +0000, Dan Purgert wrote:

> I've seen this happen with "transparent" proxies getting in the way, or
> a bad cert somewhere.  Essentially your end has cached a specific cert,
> and that's the only cert you'll accept for the remote server.

Could you please told me the step-by-step solutions you solve this issue 
for you case?

I've tried for long-time and many methods, and still cann't figure it out 
how to deal with it.

Regards
-- 
.: Hongyi Zhao [ hongyi.zhao AT gmail.com ] Free as in Freedom :.

[toc] | [prev] | [next] | [standalone]

#3936

Hongyi Zhao <hongyi.zhao@gmail.com> writes:
> Several days before, I've always access https://www.google.com via 
> firefox.  But, these days till now, when I using firefox to access 
> https://www.google.com, I meet the "Your connection is not secure" issue.
>
> For detail, the issue is as follows:
>
> ---------------
> The url used by me is https://www.google.com/ncr
>
> The issue report are as follows:
>
> Your connection is not secure
>
> The owner of www.google.com has configured their website improperly. To 
> protect your information from being stolen, Firefox has not connected to 
> this website.
>
> This site uses HTTP Strict Transport Security (HSTS) to specify that 
> Firefox may only connect to it securely. As a result, it is not possible 
> to add an exception for this certificate.
>
> Learn more…
>
> Report errors like this to help Mozilla identify and block malicious sites
>
> www.google.com uses an invalid security certificate.
>
> The certificate is only valid for the following names:
>   *.twitter.com, twitter.com  
      ^^^^^^^^^^^

I expect you are using a seriously broken proxy, either the one
described at [1] or one with a similar bug.

  [1] https://bugs.chromium.org/p/project-zero/issues/detail?id=978

> I tried many solutions found on the internet, but still cann't solve
> this issue.  Any hints for this issue?

Identify the proxy and stop using it.

-- 
http://www.greenend.org.uk/rjk/

[toc] | [prev] | [next] | [standalone]

#3937

On Mon, 09 Jan 2017 08:59:14 +0000, Richard Kettlewell wrote:

> I expect you are using a seriously broken proxy, either the one
> described at [1] or one with a similar bug.
> 
>   [1] https://bugs.chromium.org/p/project-zero/issues/detail?id=978
> 
>> I tried many solutions found on the internet, but still cann't solve
>> this issue.  Any hints for this issue?
> 
> Identify the proxy and stop using it.

Thanks a lot for your reply.  Let me told you of my case with more 
detailed info:

I'm from China.  As it's well known, google cann't be accessed freely 
from my location and I use openvpn client to connect to vpngate's [1] 
free vpn servers for surfing the internet with google.

The method used by me is policy routing based on iptables, ipset and ecmp 
under Debian Gnu/Linux.  In short, I create specific ipset to store the 
ip/net addresses of such websites, such as google. And mark the packages 
with specific fwmark value, then using conntrack to track the 
corresponding connection and routing them using vpn servers.

This method always worked for me till several days before.  So, I don't 
know why it suddenly broken these days. 

Regards

[1] For detail, see here about vpngate: http://www.vpngate.net
-- 
.: Hongyi Zhao [ hongyi.zhao AT gmail.com ] Free as in Freedom :.

[toc] | [prev] | [next] | [standalone]

#3938

Hongyi Zhao wrote:
> On Mon, 09 Jan 2017 08:59:14 +0000, Richard Kettlewell wrote:
>
>> I expect you are using a seriously broken proxy, either the one
>> described at [1] or one with a similar bug.
>> 
>>   [1] https://bugs.chromium.org/p/project-zero/issues/detail?id=978
>> 
>>> I tried many solutions found on the internet, but still cann't solve
>>> this issue.  Any hints for this issue?
>> 
>> Identify the proxy and stop using it.
>
> [...]
>
> This method always worked for me till several days before.  So, I don't 
> know why it suddenly broken these days. 

The Great Firewall has learned your deviant ways, and is now breaking
that traffic.

-- 
|_|O|_| Registered Linux user #585947
|_|_|O| Github: https://github.com/dpurgert
|O|O|O| PGP: 05CA 9A50 3F2E 1335 4DC5  4AEE 8E11 DDF3 1279 A281

[toc] | [prev] | [next] | [standalone]

#3940

On Mon, 09 Jan 2017 11:43:12 +0000, Dan Purgert wrote:

> The Great Firewall has learned your deviant ways, and is now breaking
> that traffic.

The openvpn itself uses encrypted method for communication and not so 
easy to be defeated by The Great Firewall. 

The possible reason maybe lies in that the ip/net addresses for website 
changes from time to time.  And I use pdnsd as the local dns cache 
server, and accessed a invalid ip addresses.

And the certificates for the corresponding website and ip addresses maybe 
also changes from time to time.  This will also cause issues for my case.

Finally, even if I don't use local dns cache, the google has so many ip/
net addresses ranges and changes the ip-domain map from time to time.  
This also maybe cause the issue I meet.

Regards
-- 
.: Hongyi Zhao [ hongyi.zhao AT gmail.com ] Free as in Freedom :.

[toc] | [prev] | [next] | [standalone]

#3939

Hongyi Zhao <hongyi.zhao@gmail.com> writes:
> The method used by me is policy routing based on iptables, ipset and ecmp 
> under Debian Gnu/Linux.  In short, I create specific ipset to store the 
> ip/net addresses of such websites, such as google. And mark the packages 
> with specific fwmark value, then using conntrack to track the 
> corresponding connection and routing them using vpn servers.

IP addresses for websites change from time to time; perhaps your address
tracking hasn’t caught up?

-- 
http://www.greenend.org.uk/rjk/

[toc] | [prev] | [next] | [standalone]

#3941

On Mon, 09 Jan 2017 12:00:20 +0000, Richard Kettlewell wrote:

> IP addresses for websites change from time to time; perhaps your address
> tracking hasn’t caught up?

Good analysis, also see my another post to Dan Purgert.  And currently I 
find the following method for solving my issue:

[1] Firstly, use the dig to find one valid ip for www.google.com: 

dig www.google.com @8.8.8.8  

and use the obtained ip to access https://www.google.com as follows in 
the firefox's address panel:

https://the-obtained-ip-of-www.google.com

At this point, the firefox will give the following info:

Your connection is not secure

Click on the Advanced button --> Add Exception --> Get Certificate --> 
Confirm Security Exception (check the Permanently store this exception).

[2] Add static ip - domain name map into the /etc/hosts file:

the-obtained-ip-of-www.google.com www.google.com

And the issue is solved.

p.s.  The shortcoming of the above method is that the static ip for using 
may be not the geologically close to my location, and so maybe affect the 
speed of surfing.

Regards
-- 
.: Hongyi Zhao [ hongyi.zhao AT gmail.com ] Free as in Freedom :.

[toc] | [prev] | [next] | [standalone]

#3942

Hongyi Zhao <hongyi.zhao@gmail.com> wrote:

>> IP addresses for websites change from time to time; perhaps your address
>> tracking hasn’t caught up?
> 
> Good analysis, also see my another post to Dan Purgert.  And currently I 
> find the following method for solving my issue:
> 
> [1] Firstly, use the dig to find one valid ip for www.google.com: 
> 
> dig www.google.com @8.8.8.8  

Note that DNS responses might easily be spoofed as long as there is no
DNSSEC in place and verified (http://dnsviz.net/d/google.com/dnssec/ it
looks like Google is using DNSSEC, but there are warnings...).

> and use the obtained ip to access https://www.google.com as follows in 
> the firefox's address panel:
> 
> https://the-obtained-ip-of-www.google.com

You might want to use some online DNS resolver to double-check your
IP...

> p.s.  The shortcoming of the above method is that the static ip for using 
> may be not the geologically close to my location, and so maybe affect the 
> speed of surfing.

...or ensure that your DNS-traffic get's routed through your VPN - that
way, you also should get an address fairly near your VPN endpoint which
should be beneficial to surfing speed.

HTH,

Jamma.

PS: Note that nowadays websites load such a lot of additional ressources
- I'd recommend using a static proxy for your browser and route all it's
traffic through VPN. You'll give away your IP (and maybe even what
you're doing) through advertising networks and whatnot. I'd be surprised
when The Great Firewall can't detect such things.

-- 
"What we nourish flourishes." - "Was wir nähren erblüht."

www.tisc.de

[toc] | [prev] | [next] | [standalone]

#3944

On Wed, 11 Jan 2017 17:47:15 +0000, Jamma Tino Schwarze wrote:

>> dig www.google.com @8.8.8.8

This is just a example for obtaining the ip of website.  I don't directly 
use 8.8.8.8 as my dns, instead I use vpn to route my queries to 8.8.8.8 
if I want to use 8.8.8.8 for dns query. 

> 
> Note that DNS responses might easily be spoofed as long as there is no
> DNSSEC in place and verified (http://dnsviz.net/d/google.com/dnssec/ it
> looks like Google is using DNSSEC, but there are warnings...).
> 
>> and use the obtained ip to access https://www.google.com as follows in
>> the firefox's address panel:
>> 
>> https://the-obtained-ip-of-www.google.com
> 
> You might want to use some online DNS resolver to double-check your
> IP...

Thanks for your notes.  In fact, I use dnscrypt-proxy to do the local dns 
query. 

Regards
-- 
.: Hongyi Zhao [ hongyi.zhao AT gmail.com ] Free as in Freedom :.

[toc] | [prev] | [standalone]

Back to top | Article view | comp.os.linux.networking

csiph-web