14

Firefox upgraded to version 33.0 this morning. Since then, I cannot load a specific local application over HTTPS -- note that it uses a self-signed certificate. It displays the following error message:

The key does not support the requested operation. (Error code: sec_error_invalid_key)

I cannot see anything in Firebug. I restarted Firefox in safe mode, to make sure no add-on was the problem. I also cleaned my cache and cookies. The same application opens fine with Chrome, and Firefox can open other applications that use HTTPS with a self-signed certificate.

Any idea how I could troubleshoot this issue?

Edit: Mozilla has made several important changes to security in Firefox 33.0. Details can be found here.

In my particular situation, the self-signed certificate was blocked because it was deemed too weak:

RSA 512, 1000 and 1023-bit certificates are now blocked by Firefox since they are not sufficient for security. Most certificates currently being issued should have a 2048-bit key length.

7
  • Encounter the same issue. Another thread, support.mozilla.org/en-US/questions/1018618, mentioned that it happens during beta and no action taken since by FF.
    – ChuaSH
    Oct 16, 2014 at 4:41
  • I am getting the same thing. I'm not sure there is anything you can do in FF 33 right now. Even if you tried to remove the cert and installing it again, it doesn't clear up.
    – Rob David
    Oct 16, 2014 at 14:17
  • I had uninstall 33.0, install 32.0, remove the profile, create a new one, and finally replace the profile with the old one. Everything was working fine. Then I installed 33.0 again, and the issue was back.
    – Phil
    Oct 16, 2014 at 15:48
  • Firefox 33 doesn't support self signed certificates. I had to go back to 32 because I maintain several routers and severs where I'm the only one there and just used self signed certs. No word from them how this will turn out. Report it to them. There should always be an advanced "hidden" option to turn off or on anything. I hope they change their mind, or I guess I stay on version 32 for a long long time.
    – user4153778
    Oct 17, 2014 at 13:24
  • 1
    You are wrong. Firefox 33 supports self-signed certificates. I suspect that a key length is a problem here. Oct 23, 2014 at 2:01

3 Answers 3

14

I have encountered the same problem after upgrading to Firefox 33 with Tomato router. The key length is a problem here.

Tomato generates 512 bit long RSA key by default. However, Firefox 33 requires minimum 1024 bit key.

I had to manually generate a longer key in Tomato.

I did that following way:

  1. Log in using ssh to the router.
  2. cd /tmp
  3. cp /usr/sbin/gencert.sh .
  4. chmod +w gencert.sh
  5. Edit the gencert.sh file you copied and change the following line:

    openssl req -new -out /tmp/cert.csr -config openssl.config -keyout /tmp/privkey.pem -newkey rsa:512 -passout pass:password

    into:

    openssl req -new -out /tmp/cert.csr -config openssl.config -keyout /tmp/privkey.pem -newkey rsa:1024 -passout pass:password

  6. ./gencert.sh $(date +%s)
  7. nvram unset https_crt_file
  8. nvram commit
  9. service httpd restart

Now httpd will use the new certificate. If you have "Save in NVRAM" checkbox enabled it will be saved in NVRAM and survive router reboot.

Do not check "Regenerate" checkbox, because automatically regenerated certificates are still 512 bit long.

If you remove your certificate from NVRAM, you must repeat procedure described above.

Firefox 34 and newer:

Starting from Firefox 34 you need to additionally enable SSL 3.0 support in Firefox configuration:

  1. Enter about:config address in the URL bar.
  2. Set the following options to 0:

    security.tls.version.fallback-limit
    security.tls.version.min
    
3
  • Is there any reason why you didnt edit the gencert.sh file in place ie make the changes permanent? Nov 17, 2014 at 23:10
  • Router's file system is read-only. You can write to it only by uploading firmware blobs. Nov 18, 2014 at 0:15
  • Is there any way to enable other ciphers other than SSLv3.0 for httpd on tomato router? This is with regards to Firefox 34 dropping support for SSLv3.0. I would like to avoid having to use SSLv3.0 altogether rather then using the about:config settings.
    – moo
    Dec 15, 2014 at 16:36
3

For Webmin: I created a new ssl certificate and now it is working with FF 33.

Webmin -> Webmin Configuration -> SSL Encryption -> Self-Signed Certificate

1
-6

turned off Hardware acceleration in the Options> Advanced > General Tab Problem cleared up

0

Not the answer you're looking for? Browse other questions tagged or ask your own question.