Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #234101 > unrolled thread

Can't connect to torproject.org

Back to article view | Back to linux.debian.user

Contents

  Can't connect to torproject.org Celejar <celejar@gmail.com> - 2021-04-11 16:30 +0200
    Re: Can't connect to torproject.org <tomas@tuxteam.de> - 2021-04-11 16:40 +0200
      Re: Can't connect to torproject.org Celejar <celejar@gmail.com> - 2021-04-11 17:10 +0200
        Re: Can't connect to torproject.org tomas@tuxteam.de - 2021-04-11 17:30 +0200
    Re: Can't connect to torproject.org Kushal Kumaran <kushal@locationd.net> - 2021-04-11 17:00 +0200
      Re: Can't connect to torproject.org Celejar <celejar@gmail.com> - 2021-04-11 17:10 +0200
      Re: Can't connect to torproject.org <tomas@tuxteam.de> - 2021-04-11 17:10 +0200
        Re: Can't connect to torproject.org ellanios82 <ellanios82@gmail.com> - 2021-04-11 18:00 +0200
    Re: Can't connect to torproject.org Eduardo M KALINOWSKI <eduardo@kalinowski.com.br> - 2021-04-11 18:00 +0200
      [Solved] Re: Can't connect to torproject.org Celejar <celejar@gmail.com> - 2021-04-11 18:20 +0200
        Re: [Solved] Re: Can't connect to torproject.org <tomas@tuxteam.de> - 2021-04-11 19:00 +0200
          Re: [Solved] Re: Can't connect to torproject.org Celejar <celejar@gmail.com> - 2021-04-11 19:20 +0200
            Re: [Solved] Re: Can't connect to torproject.org tomas@tuxteam.de - 2021-04-11 20:30 +0200
        Re: [Solved] Re: Can't connect to torproject.org Charles Curley <charlescurley@charlescurley.com> - 2021-04-11 23:50 +0200

#234101 — Can't connect to torproject.org

I feel silly for not being able to figure this out.

I can't connect to torproject.org via either Firefox or Chromium. The
browsers object that HSTS is in place and they don't recognize the
site's certificate (SEC_ERROR_UNKNOWN_ISSUER). There's no opportunity
offered to add an exception.

I've seen these threads:

https://support.mozilla.org/en-US/questions/1201504
https://superuser.com/questions/1066863/how-can-i-add-a-certificate-exception-for-an-hsts-protected-site-in-firefox
https://support.mozilla.org/en-US/questions/942924

But I don't see any good suggestions for fixing this in my case. I have
a pretty standard Debian installation, with standard certificates
installed, and no customization to my local certificate infrastructure.
I'm connecting via Verizon FioS, with no proxy in use (on my end, at
least).

Celejar

[toc] | [next] | [standalone]

#234102

[Multipart message — attachments visible in raw view] — view raw

On Sun, Apr 11, 2021 at 10:25:24AM -0400, Celejar wrote:
> I feel silly for not being able to figure this out.
> 
> I can't connect to torproject.org via either Firefox or Chromium. The
> browsers object that HSTS is in place and they don't recognize the
> site's certificate (SEC_ERROR_UNKNOWN_ISSUER). There's no opportunity
> offered to add an exception.

Funny. I just tried https://torproject.org/ with firefox (78.8.0esr)
and it didn't complain.

That said, I definitely remember struggling with situations à la
"no, I won't let you connect to that site because the certificate
is BAD and I know better than you, dammit".

Each of those times I haven't changed my browser for lack of less-bad
alternatives :-(

Cheers
 - t

[toc] | [prev] | [next] | [standalone]

#234108

On Sun, 11 Apr 2021 16:32:10 +0200
<tomas@tuxteam.de> wrote:

> On Sun, Apr 11, 2021 at 10:25:24AM -0400, Celejar wrote:
> > I feel silly for not being able to figure this out.
> > 
> > I can't connect to torproject.org via either Firefox or Chromium. The
> > browsers object that HSTS is in place and they don't recognize the
> > site's certificate (SEC_ERROR_UNKNOWN_ISSUER). There's no opportunity
> > offered to add an exception.
> 
> Funny. I just tried https://torproject.org/ with firefox (78.8.0esr)
> and it didn't complain.

I have no problem accepting that there's something wrong with my
configuration - I assume there is, since if it's a general problem, I'd
expect a lot more discussion / complaining online - but I just can't
figure out what it is. And whatever it is, it's affecting both Firefox
and Chromium.

> That said, I definitely remember struggling with situations à la
> "no, I won't let you connect to that site because the certificate
> is BAD and I know better than you, dammit".
> 
> Each of those times I haven't changed my browser for lack of less-bad
> alternatives :-(

Celejar

[toc] | [prev] | [next] | [standalone]

#234109

[Multipart message — attachments visible in raw view] — view raw

On Sun, Apr 11, 2021 at 11:06:24AM -0400, Celejar wrote:
> On Sun, 11 Apr 2021 16:32:10 +0200
> <tomas@tuxteam.de> wrote:
> 
> > On Sun, Apr 11, 2021 at 10:25:24AM -0400, Celejar wrote:
> > > I feel silly for not being able to figure this out.
> > > 
> > > I can't connect to torproject.org via either Firefox or Chromium. The
> > > browsers object that HSTS is in place and they don't recognize the
> > > site's certificate (SEC_ERROR_UNKNOWN_ISSUER). There's no opportunity
> > > offered to add an exception.
> > 
> > Funny. I just tried https://torproject.org/ with firefox (78.8.0esr)
> > and it didn't complain.
> 
> I have no problem accepting that there's something wrong with my
> configuration - I assume there is, since if it's a general problem, I'd
> expect a lot more discussion / complaining online - but I just can't
> figure out what it is. And whatever it is, it's affecting both Firefox
> and Chromium.
> 
> > That said, I definitely remember struggling with situations à la
> > "no, I won't let you connect to that site because the certificate
> > is BAD and I know better than you, dammit".
> > 
> > Each of those times I haven't changed my browser for lack of less-bad
> > alternatives :-(

OK. I spotted my notes from back then. There were some expletives
there I won't repeat here.

What helped in my case was (Firefox):

  rm SecurityPreloadState.txt SiteSecurityServiceState.txt

in whatever Mozilla profile you use (they are top-level in the
profile directory), i.e. typically ~/.mozilla/firefox/xxxxx.default
with some funny value for xxxxx.

I'm a bit short on time to check whether this just repeats one of
the solutions given in your links.

Good luck
 - t

[toc] | [prev] | [next] | [standalone]

#234105

On Sun, Apr 11 2021 at 10:25:24 AM, Celejar <celejar@gmail.com> wrote:
> I feel silly for not being able to figure this out.
>
> I can't connect to torproject.org via either Firefox or Chromium. The
> browsers object that HSTS is in place and they don't recognize the
> site's certificate (SEC_ERROR_UNKNOWN_ISSUER). There's no opportunity
> offered to add an exception.
>
> I've seen these threads:
>
> https://support.mozilla.org/en-US/questions/1201504
> https://superuser.com/questions/1066863/how-can-i-add-a-certificate-exception-for-an-hsts-protected-site-in-firefox
> https://support.mozilla.org/en-US/questions/942924
>
> But I don't see any good suggestions for fixing this in my case. I have
> a pretty standard Debian installation, with standard certificates
> installed, and no customization to my local certificate infrastructure.
> I'm connecting via Verizon FioS, with no proxy in use (on my end, at
> least).
>

Instructions at https://msutexas.edu/library/clearhsts.php to make the
browser forget about the HSTS specified for a domain.

-- 
regards,
kushal

[toc] | [prev] | [next] | [standalone]

#234106

On Sun, 11 Apr 2021 07:55:41 -0700
Kushal Kumaran <kushal@locationd.net> wrote:

> On Sun, Apr 11 2021 at 10:25:24 AM, Celejar <celejar@gmail.com> wrote:
> > I feel silly for not being able to figure this out.
> >
> > I can't connect to torproject.org via either Firefox or Chromium. The
> > browsers object that HSTS is in place and they don't recognize the
> > site's certificate (SEC_ERROR_UNKNOWN_ISSUER). There's no opportunity
> > offered to add an exception.
> >
> > I've seen these threads:
> >
> > https://support.mozilla.org/en-US/questions/1201504
> > https://superuser.com/questions/1066863/how-can-i-add-a-certificate-exception-for-an-hsts-protected-site-in-firefox
> > https://support.mozilla.org/en-US/questions/942924
> >
> > But I don't see any good suggestions for fixing this in my case. I have
> > a pretty standard Debian installation, with standard certificates
> > installed, and no customization to my local certificate infrastructure.
> > I'm connecting via Verizon FioS, with no proxy in use (on my end, at
> > least).
> >
> 
> Instructions at https://msutexas.edu/library/clearhsts.php to make the
> browser forget about the HSTS specified for a domain.

Thanks. I tried a couple of the methods from that page (the one for
Chrome, and Option 2 for Firefox), but the problem remains.

Celejar

[toc] | [prev] | [next] | [standalone]

#234107

[Multipart message — attachments visible in raw view] — view raw

On Sun, Apr 11, 2021 at 07:55:41AM -0700, Kushal Kumaran wrote:
> On Sun, Apr 11 2021 at 10:25:24 AM, Celejar <celejar@gmail.com> wrote:
> > I feel silly for not being able to figure this out.
> >
> > I can't connect to torproject.org via either Firefox or Chromium. The
> > browsers object that HSTS is in place [...]

> Instructions at https://msutexas.edu/library/clearhsts.php to make the
> browser forget about the HSTS specified for a domain.

Not the OP, but some responder. Ah... GAH! It was that. Sorry for not
seeing it in the OP and thanks, Kushal, for sticking my nose into it.

Cheers
 - t

[toc] | [prev] | [next] | [standalone]

#234111

On 4/11/21 6:04 PM, tomas@tuxteam.de wrote:

> > thanks, Kushal


  - some folks find convenient to use "Tails" on usb stick


<https://tails.boum.org/doc/about/requirements/index.en.html>


....

  rgds

[toc] | [prev] | [next] | [standalone]

#234110

On 11/04/2021 11:25, Celejar wrote:
> I feel silly for not being able to figure this out.
> 
> I can't connect to torproject.org via either Firefox or Chromium. The
> browsers object that HSTS is in place and they don't recognize the
> site's certificate (SEC_ERROR_UNKNOWN_ISSUER). There's no opportunity
> offered to add an exception.
> 
> I've seen these threads:
> 
> https://support.mozilla.org/en-US/questions/1201504
> https://superuser.com/questions/1066863/how-can-i-add-a-certificate-exception-for-an-hsts-protected-site-in-firefox
> https://support.mozilla.org/en-US/questions/942924
> 
> But I don't see any good suggestions for fixing this in my case. I have
> a pretty standard Debian installation, with standard certificates
> installed, and no customization to my local certificate infrastructure.
> I'm connecting via Verizon FioS, with no proxy in use (on my end, at
> least).

There seems to be to issues:

- The certificate issuer is invalid
- Since the site uses HSTS[0], the browser does not allow the user to 
override the certificate problem.

[0]https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security

HSTS doesn't really seem to be problem. It just tells the browser that 
https is to be used at all times. If there's a certificate error, that 
means that TLS is being used.

The real question is then why is the issuer considered invalid. I can 
access the site normally and it uses a Let's Encrypt certificate, which 
should be trusted, and should be used by many other sites.

What happens when you try to access https://letsencrypt.org/, which is 
signed by the same CA?


-- 
Persistence in one opinion has never been considered a merit in political
leaders.
		-- Marcus Tullius Cicero, "Ad familiares", 1st century BC

Eduardo M KALINOWSKI
eduardo@kalinowski.com.br

[toc] | [prev] | [next] | [standalone]

#234112 — [Solved] Re: Can't connect to torproject.org

On Sun, 11 Apr 2021 12:51:13 -0300
Eduardo M KALINOWSKI <eduardo@kalinowski.com.br> wrote:

> On 11/04/2021 11:25, Celejar wrote:
> > I feel silly for not being able to figure this out.
> > 
> > I can't connect to torproject.org via either Firefox or Chromium. The
> > browsers object that HSTS is in place and they don't recognize the
> > site's certificate (SEC_ERROR_UNKNOWN_ISSUER). There's no opportunity
> > offered to add an exception.
> > 
> > I've seen these threads:
> > 
> > https://support.mozilla.org/en-US/questions/1201504
> > https://superuser.com/questions/1066863/how-can-i-add-a-certificate-exception-for-an-hsts-protected-site-in-firefox
> > https://support.mozilla.org/en-US/questions/942924
> > 
> > But I don't see any good suggestions for fixing this in my case. I have
> > a pretty standard Debian installation, with standard certificates
> > installed, and no customization to my local certificate infrastructure.
> > I'm connecting via Verizon FioS, with no proxy in use (on my end, at
> > least).
> 
> There seems to be to issues:
> 
> - The certificate issuer is invalid
> - Since the site uses HSTS[0], the browser does not allow the user to 
> override the certificate problem.
> 
> [0]https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security
> 
> HSTS doesn't really seem to be problem. It just tells the browser that 
> https is to be used at all times. If there's a certificate error, that 
> means that TLS is being used.
> 
> The real question is then why is the issuer considered invalid. I can 
> access the site normally and it uses a Let's Encrypt certificate, which 
> should be trusted, and should be used by many other sites.
> 
> What happens when you try to access https://letsencrypt.org/, which is 
> signed by the same CA?

It connects fine. And you've just given the the clue to figure this
out: on my system, the certificate is issued by Cisco Umbrella, not
Let's Encrypt!

The problem seems to be that I have OpenDns Family Shield configured at
the router level, and it blocks Proxy/Anonymizer sites by default.
(OpenDns was purchased by Cisco and rebranded as Cisco Umbrella:
https://umbrella.cisco.com/opendns-cisco-umbrella.) I'm pretty sure that
it used to just return an OpenDns page instead of the requested one,
but now I guess it's doing something sneaky by returning its own
version of the requested page, signed with its own certificate :| (I
confirmed that I have the same problem accessing openvpn.net)

Thanks!

Celejar

[toc] | [prev] | [next] | [standalone]

#234113 — Re: [Solved] Re: Can't connect to torproject.org

[Multipart message — attachments visible in raw view] — view raw

On Sun, Apr 11, 2021 at 12:16:55PM -0400, Celejar wrote:
> On Sun, 11 Apr 2021 12:51:13 -0300
> Eduardo M KALINOWSKI <eduardo@kalinowski.com.br> wrote:

[...]

> > What happens when you try to access https://letsencrypt.org/, which is 
> > signed by the same CA?
> 
> It connects fine. And you've just given the the clue to figure this
> out: on my system, the certificate is issued by Cisco Umbrella, not
> Let's Encrypt!

[...]

Woah.

I tried to look this up. After I got past Cisco's carpet-spamming
of search engines, what this umbrella thing seems to do is to
play man-in-the-middle!

Umbrella. Gotta remember that name.

Thanks to all for teaching me something :)

Cheers
 - t

[toc] | [prev] | [next] | [standalone]

#234115 — Re: [Solved] Re: Can't connect to torproject.org

On Sun, 11 Apr 2021 18:51:20 +0200
<tomas@tuxteam.de> wrote:

> On Sun, Apr 11, 2021 at 12:16:55PM -0400, Celejar wrote:
> > On Sun, 11 Apr 2021 12:51:13 -0300
> > Eduardo M KALINOWSKI <eduardo@kalinowski.com.br> wrote:
> 
> [...]
> 
> > > What happens when you try to access https://letsencrypt.org/, which is 
> > > signed by the same CA?
> > 
> > It connects fine. And you've just given the the clue to figure this
> > out: on my system, the certificate is issued by Cisco Umbrella, not
> > Let's Encrypt!
> 
> [...]
> 
> Woah.
> 
> I tried to look this up. After I got past Cisco's carpet-spamming
> of search engines, what this umbrella thing seems to do is to
> play man-in-the-middle!
> 
> Umbrella. Gotta remember that name.
> 
> Thanks to all for teaching me something :)

Hey, look at the bright side: this is a classic example of HTTPS / HSTS
architecture working exactly as it's supposed to!

Celejar

[toc] | [prev] | [next] | [standalone]

#234117 — Re: [Solved] Re: Can't connect to torproject.org

[Multipart message — attachments visible in raw view] — view raw

On Sun, Apr 11, 2021 at 01:14:54PM -0400, Celejar wrote:
> On Sun, 11 Apr 2021 18:51:20 +0200
> <tomas@tuxteam.de> wrote:

> > [&@&%*#$ cisco umbrella]
> 
> Hey, look at the bright side: this is a classic example of HTTPS / HSTS
> architecture working exactly as it's supposed to!

Indeed :-)

Cheers
 - t

[toc] | [prev] | [next] | [standalone]

#234120 — Re: [Solved] Re: Can't connect to torproject.org

On Sun, 11 Apr 2021 12:16:55 -0400
Celejar <celejar@gmail.com> wrote:

> It connects fine. And you've just given the the clue to figure this
> out: on my system, the certificate is issued by Cisco Umbrella, not
> Let's Encrypt!
> 
> The problem seems to be that I have OpenDns Family Shield configured
> at the router level, and it blocks Proxy/Anonymizer sites by default.

Yikes! I find that utterly unacceptable. Yet another reason to run
one's own local DNS server. Which I have been doing for more than 20
years.

-- 
Does anybody read signatures any more?

https://charlescurley.com
https://charlescurley.com/blog/

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web