Firefox says "Secure Connection Failed" but certificate works in Chrome, Edge, Brave, and Opera

Help
21

Perfect!

  1. Make a copy of certificate.crt and name it ca.crt.
  2. Edit ca.crt and delete the first of the three certificates in that file. You can tell them apart by the header and footer lines for each certificate.
  3. Upload that ca.crt.
22

It worked!

:partying_face:

That's what I'm talking about! :sunglasses:

https://decoder.link/sslchecker/katearbon.com/443

You've even got the "long chain", which provides maximal compatibility. Many, many people have struggled here for the past week to achieve that.

23

Yay! Thank you so much for your help. :partying_face:

24

You might want to let Blacknight know that they need to update their Apache TLS/SSL configurations to:

  1. Remove TLS 1.0 and 1.1 support.
  2. Make sure the cipher suites their servers are using are strong.

Here's a great reference for them for both:

https://ssl-config.mozilla.org/#server=apache&version=2.4.41&config=intermediate&openssl=1.1.1k&guideline=5.6

That will also help them fix their OCSP stapling issues as well.

25

What part of the report is indicative of the "long chain"?

Thanks, I'll inform Blacknight of the necessary updates.

26

If you look here:

https://decoder.link/sslchecker/katearbon.com/443

You'll see three certificates. The "short chain" is only the first two certificates (your leaf and R3). The "long chain" also includes ISRG Root X1.

I updated your SSL Labs test. You'll see it there too:

https://www.ssllabs.com/ssltest/analyze.html?d=www.katearbon.com&hideResults=on

You can ignore the CRL Error in certificate 3 and the expiration of certificate 4 (DST Root CA X3), which you can read about in the news worldwide at this point.

27

Thanks again. Sent you the price of a few beers. :beer:

28

Thanks for the :beers: !

:smiley: