topic Re: SSL Decryption Firefox issue in General Topics

SSL Decryption Firefox issue

markk96 — Fri, 18 Jul 2014 20:14:53 GMT

I am testing SSL Decryption and have setup the certs.

IE and Chrome work like expected. But firefox is having an issue with untrusted site error (Error code: sec_error_untrusted_issuer)

Has anyone worked around this problem before?

Re: SSL Decryption Firefox issue

markk96 — Fri, 18 Jul 2014 20:15:54 GMT

I also want to say I have deleted my cookies like it said to in the Knowledge base, but this did not fix it, i also have deleted the files out of the profiles folder as well for firefox.

Re: SSL Decryption Firefox issue

hshah — Fri, 18 Jul 2014 20:21:01 GMT

Hi Mark,

IE and Chrome uses same Certificate repository, while Mozilla uses different one.

You are supposed to import certificate to Mozilla Certificate repository. It should work fine from there.

Regards,

Hardik Shah

Re: SSL Decryption Firefox issue

markk96 — Fri, 18 Jul 2014 20:25:00 GMT

Thanks for the reply, I have imported it. I followed this URL to generate the cert and sub cert.

How to Implement Certificates Issued from Microsoft Certificate Services

Our domain machines already have the at cert trusted. I have tried importing it into the Firefox certs, but still it does not work.

Re: SSL Decryption Firefox issue

hshah — Fri, 18 Jul 2014 20:25:24 GMT

How to import Cert in Mozilla repository?

Re: SSL Decryption Firefox issue

hshah — Fri, 18 Jul 2014 20:26:10 GMT

Import cert as mentioned in above post, it should work fine.

Re: SSL Decryption Firefox issue

HULK — Fri, 18 Jul 2014 20:27:08 GMT

For example:

Thanks

Re: SSL Decryption Firefox issue

markk96 — Fri, 18 Jul 2014 20:41:20 GMT

Thank you, this solved my problem.

My next question what about items like dropbox app, does the cert then have to sit on the machine?

Re: SSL Decryption Firefox issue

hshah — Fri, 18 Jul 2014 20:44:51 GMT

Hi Mark,

Please provide more detail for better understanding.

Regards,

Hardik Shah

Re: SSL Decryption Firefox issue

markk96 — Fri, 18 Jul 2014 20:50:54 GMT

If our machines have something like the dropbox application on it, I assume then the traffic is using the local pc certificate store where our root cert is. Does that make sense?

Re: SSL Decryption Firefox issue

jvalentine — Fri, 18 Jul 2014 20:56:18 GMT

My next question what about items like dropbox app, does the cert then have to sit on the machine?

AFAIK Dropbox uses a hard-coded client certificate embedded in the dropbox application and won't accept what is in the Windows and/or Firefox certificate store. Your choices are (in no specific order):

1.) permit it knowing you can't decrypt it

2.) block it because you can't decrypt it

3.) limit its use to specific people because you can't decrypt it

4.) find a different solution that is more flexible with certificates and SSL MITM

Re: SSL Decryption Firefox issue

hshah — Fri, 18 Jul 2014 20:57:38 GMT

Hi Mark,

For all applications using SSL decryption, process is same. Lets say google drive uses SSL decryption, then it will work the same way gmail works. No difference.

Howe very, there are some application which do not support SSL decryption.

List of Applications Excluded from SSL Decryption

Regards,

Hardik Shah