Secure Connection Failed - Forum on FireFox

[Enjay]

I'm sticking this here because I suspect its a specific to me thing, rather than something wider.

In recent days, I've been having a problem with the forum when I use FireFox (which I normally do).

If I visit the forum, I can (usually) browse all the pages no problem and sometimes post as well.
However, quite often when I try to make a post I get the following:

After that, I can't browse the forum at all. Every page I try to visit gives me the same "Secure Connection Failed" error page.

Eventually, and for no obvious reason, browsing becomes possible again* but, if I try to post something, I get the error again.
*quitting and restarting FireFox does usually seem to do it.
If I use Chrome (as I am doing now) it's fine.
I have done the usual things - clearing cache, deleting cookies - but I still have the problem. It's been going on for (I think) three days now. (So, obviously, I have also restarted my computer several times in that period too.)
All other websites and Forums that I visit are fine.

I can't be certain if it's related or not, but three days ago I got a "500 Internal Server Error" for a while when trying to visit the forum and now this happens.

Anyone got any suggestions?
It's really frustrating using my browser of choice, going to post something, having it fail, and having to switch browsers.

[edit] Hmmm... I wonder if my system has developed the same problem as devlman127 reported here: viewtopic.php?p=1259606 He never did actually say what he meant by "can't access the zdoom forums on Firefox". [/edit]

[edit2] For what it's worth, once I have started getting the "Secure Connection Failed" error on all forum pages, I can still visit the Wiki pages without issue. [/edit2]

[edit3] In the Privacy & Security part of the settings options, zdoom.org had its own entry in the Certificates section. Deleting that certificate has not improved the situation. [/edit3]

[Rachael]

Yesterday we had someone with a similar problem and apparently he had a lot of "premium" software installed alongside his Avast.

That software was hijacking his connection and making him unable to connect to the site, it was causing his browser to send malformed HTTP headers.

Once the software was removed suddenly the problems went away.

How much security software do you have installed on that system?

[Enjay]

Just Avira antivirus - which I have used for many years. I'll try disabling it the next time the problem happens.

[Enjay]

Nope, that doesn't seem to be it.

I actually thought that things might have fixed themselves. I've made several posts today, and restarted my computer a few times too.
However, with no obvious difference from previous times today, I tried to make a post and got the secure connection failed problem.
I have disabled my Antivirus and still have the problem.

[Kappes Buur]

Not sure if this will help, I use Opera.
I seem to have hit a lucky streak, the last 3 days I could log into the forum
without problem. Previously, more often than not, no connection could be
established. When that happened I had to go into settings and untick
Proxy Server and tick Automatically detect settings.

---

[Enjay]

Thanks for the suggestion, but it didn't help. In fact, my system was already set in the way your screen shot has it. I tried toggling things but still the same problem.

[edit] For what it's worth, I also sometimes use Opera and it's fine for me. It really does seem to be restricted to FireFox for some reason. [/edit]

[Dark-Assassin]

Can you access the Zandronum forums at all? Or even it's main website?
If not, you should check to see if HTTP/2 is enabled in Firefox. Both sites require it.
Open about:config and search for network.http.http2.enabled and see if it's true.

[Enjay]

Yep, I can see the Zandrounum forum and network.http.http2.enabled is true.
To be fair, I can also visit the ZDoom forums for a while, and then the problem triggers for some reason. It always seems to trigger when I try to make a post (I can make posts for a while, but then for some reason while making a post the problem triggers, even though I have posted successfully earlier in that same session). Once the problem has occurred, I can't visit any ZDoom forum pages using FireFox until I quit Firefox and restart it. Other browsers do not seem to be affected and, as I mentioned before, I can even visit the ZDoom wiki when I can't visit the forum.

I have made a bit of potential progress though.

When ZDoom forums are not working for me, if I click on the "not secure" thing in the address bar and look at the further information, it says:
"Owner: This web site does not supply ownership information.
Verified by: Not specified"

The second line seems to be the important one because...

When I am able to connect, I get:
"Owner: This web site does not supply ownership information.
Verified by: CN=Avira Security NetProtection Root 3, C=EN"


Even with my antivirus disabled, I can't get the "Verified by" to not be Avira. The fact that Avira is there does suggest that Rachael might be right about the problem stemming from my antivirus software (Avira).

Quite why Avira is able to verify the certificate for a while and then loses that ability, I don't know.

Anyway, after a bit of Googling and finding a Mozilla help page, I found that there is an option in Firefox called "security.certerrors.mitm.auto_enable_enterprise_roots" If I set this to false and restart my computer, I now get:
"Owner: This web site does not supply ownership information.
Verified by: Let's Encrypt"

So, that has got rid of Avira verifying the certificate.

I hope that setting this option to false might work (it seems to be working right now, but then it was also working earlier today when Avira was doing the verification). If it comes back then, for whatever reason, it won't only be the Avira verification service that somehow loses the ability to verify the ZDoom security certificate. We'll see.

I also read on that page that there is another option called "security.enterprise_roots.enabled" that the page suggested changing to false. However, that one is greyed out and I can't change it. I've Googled that too, and I'm not alone in having that problem, but I haven't found anything that allows me to change it. However, if the first option works, perhaps I don't need to.

[phantombeta]

What the shit.

So, that "verified by" thing doesn't mean Avira is "verifying" the site... It means the SSL encryption certificate was issued by that organization.
It saying it's "verified by" Avira means Avira has installed some root certificate (a certificate that can issue other certificates), and is using that to Man In The Middle your connection to ZDoom.org.

Absolutely disturbing, and personally I would recommend scouring that AV from your system, and looking up how to properly remove that root certificate from your system. (do be careful when doing so, if you remove a legit certificate you could make it impossible to access some sites!)

[Enjay]

Reading around the issue, it is very common for antivirus programs to do this. I've found posts from several people, with a number of different antivirus programs where something similar has happened. Not saying it's good, but it's not unusual and Mozilla acknowledges and talks about it like it's normal too.

I am going to do more digging though to try and find out if it can be removed globally. All my changes have done is remove this from Firefox. Other browsers are still using Avira.

[edit] I have emailed Avira asking for an explanation, and how to remove/disable this. Further reading has also flagged up that a very similar problem was experienced a couple of years ago with FireFox and "Avira Security NetProtection Root 2". At that time, it seems to have been tracked down to an Avira bug and resolved (information from the Mozilla support site). [/edit]

[edit2] Ack! despite the fact the Firefox option is disabled, "Avira Security NetProtection" has returned, along with the secure access problem. [/edit2]

[edit3] I finally found that it seems to be the "Web protection" feature of Avira that is responsible for this. I thought it would be the "real-time protection" option, but that's something else. With "Web protection" disabled, the site certificate is shown to be verified by "Let's Encrypt" again - and that's true in all browsers. Whether "Web protection" is more than just this feature or not, I can't say. I'll wait to see what the reply from Avira says. [/edit3]

[Rachael]

What the shit.

So, that "verified by" thing doesn't mean Avira is "verifying" the site... It means the SSL encryption certificate was issued by that organization.
It saying it's "verified by" Avira means Avira has installed some root certificate (a certificate that can issue other certificates), and is using that to Man In The Middle your connection to ZDoom.org.

Absolutely disturbing, and personally I would recommend scouring that AV from your system, and looking up how to properly remove that root certificate from your system. (do be careful when doing so, if you remove a legit certificate you could make it impossible to access some sites!)

I was ranting about this very thing the other day. Security software is becoming the very software that it was supposed to protect us against in the first place - and I wish that was a joke.

[Enjay]

I was ranting about this very thing the other day. Security software is becoming the very software that it was supposed to protect us against in the first place - and I wish that was a joke.

The first one I remember ranting about was Norton. Back in the day (like waaaay back), Norton was associated with a suite of really useful utils that were essential to any DOS user. As those utils became less and less useful/relevant, the emphasis moved more towards security software, but Norton Security very quickly became a bloated, invasive piece of garbage that threaded itself inextricably throughout the operating system and became a bigger problem than the intentionally harmful stuff it was meant to stop.