Why does Firefox show a SSL warning

Question

In Ubuntu 14.10 (Firefox 36.0.1) this site shows a SSL warning:

https://robot.your-server.de/

(sec_error_unknown_issuer)

However on my Lubuntu 14.04 machine also with Firefox 36.0.1 there is no warning.

What does this warning mean exactly and is this a potential threat?

Answer 1

This looks like the typical problem where the server does not send the complete certificate chain, as explained here.

But this time it has an additional and interesting twist: if you check out the site with SSLLabs it does not report any chain issues. If you use openssl s_client... to connect to the site it also shows that the site sends the full chain (including the root certificate, which it should not). But if you take other tools to check you might fail instead because the site sends only the lead certificate and misses the necessary chain certificates.

It took me a while to figure it out, but at the end it turned out to be a misconfigured server: As long as you use IPv4 the server returns the full certificate chain, but if you use IPv6 the server returns only the leaf certificate. This means that all the successful tools used IPv4, all the tools with errors used IPv6. As for the browsers: the failed browser must have used IPv6, the other might have used it too, but might have this certificate cached from visiting other sites using the same chain certificate.

Answer 2

Check your system's time and date. Sometimes, SSL warnings are a result of the computer's time and date being set incorrectly meaning the certificate is invalid (either too new, or too old).

I've had this issue on my own website, which was resolved after I actually reset my system clock to an accurate time.