Search Support

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Learn More

Getting sec_error_inadequate_cert_type with Private SSL Cert

  • 6 replies
  • 7 have this problem
  • 1 view
  • Last reply by Brad

more options

Howdy,

I run a Private Certificate Authority for my personal use and just to learn about SSL Certs. However, with the current build of FireFox I'm on ( 31 ) I can no longer visit sites I've secured with SSL Certs signed by this certificate authority, even though these SSL certs work just perfectly fine in Chrome and Internet Explorer. I keep getting a "sec_error_inadequate_cert_type" error. I can only assume that the certs I've been issuing are incorrect in some way, but the error is so vague and the error page doesn't specify more.

I only discovered this when I realized some of my SSL certs had expired, and I went to re-issue them.

One of the certs that hasn't expired yet but is experiencing problems can be found here:

One of the Certs I've tried re-issuing, matching fields included as closely as I can to a Google SSL cert that I looked up is here:

These certificates were generated using the application called SimpleAuthority, found here: http://simpleauthority.com/

A Site like Networking4All.com seems to believe the Certs are valid, excepting the CA that is Self Signed: http://www.networking4all.com/en/support/tools/site+check/report/?fqdn=phpmyadmin.endofevolution.com&protocol=https

Interestingly enough, using a different site like SSLShopper shows an error similar to FF31: http://www.sslshopper.com/ssl-checker.html#hostname=https://phpmyadmin.endofevolution.com

The certs are running on an Apache Web server: Apache/2.2.21 (Win32) mod_ssl/2.2.21 OpenSSL/1.0.0e PHP/5.3.10

The CA Cert is in FireFox's store as trusted.

If needed, I can provide certs.

Howdy, I run a Private Certificate Authority for my personal use and just to learn about SSL Certs. However, with the current build of FireFox I'm on ( 31 ) I can no longer visit sites I've secured with SSL Certs signed by this certificate authority, even though these SSL certs work just perfectly fine in Chrome and Internet Explorer. I keep getting a "sec_error_inadequate_cert_type" error. I can only assume that the certs I've been issuing are incorrect in some way, but the error is so vague and the error page doesn't specify more. I only discovered this when I realized some of my SSL certs had expired, and I went to re-issue them. One of the certs that hasn't expired yet but is experiencing problems can be found here: * https://forums.silicateillusion.org One of the Certs I've tried re-issuing, matching fields included as closely as I can to a Google SSL cert that I looked up is here: * https://phpmyadmin.endofevolution.com These certificates were generated using the application called SimpleAuthority, found here: http://simpleauthority.com/ A Site like Networking4All.com seems to believe the Certs are valid, excepting the CA that is Self Signed: http://www.networking4all.com/en/support/tools/site+check/report/?fqdn=phpmyadmin.endofevolution.com&protocol=https Interestingly enough, using a different site like SSLShopper shows an error similar to FF31: http://www.sslshopper.com/ssl-checker.html#hostname=https://phpmyadmin.endofevolution.com The certs are running on an Apache Web server: Apache/2.2.21 (Win32) mod_ssl/2.2.21 OpenSSL/1.0.0e PHP/5.3.10 The CA Cert is in FireFox's store as trusted. If needed, I can provide certs.

Chosen solution

I discovered the problem: The CA Certificate I was using had extended usage included.

Refer to Bug: 1049176

I confirmed this by generating a new test CA with the the extended usage field excluded, then generating a new SSL Cert The certificate verifies properly now.

While I am relieved I have figured out what the problem is, being so vague with the error message is making me lean towards another browser for primary usage. The fact it took me 4 days and an extremely large amount of work to figure out why this was occurring was unacceptable, all because the error description was generic and included absolutely no details what so ever.

Read this answer in context 👍 2

All Replies (6)

more options

I get this error in Google Chrome as well.

Current Firefox releases no longer allow to add an exception with the switch to PKIX. You would have to disable PKIX temporarily when visiting a site that doesn't work with it.

  • Bug 1034124 - mozilla::pkix: the error encountered when a CA certificate is used as an end-entity is not overridable

Note that you won't be able to do this with the next 33 Firefox version as support for this pref has been removed.

  • Bug 975229 - Remove NSS-based certificate verification

There are more changes to certificates, see:

Modified by cor-el

more options

I however, do not. It's something specific to Firefox I seem to be having. Maybe I'm running an outdated version of Chrome? Which would be hard seeing as chrome itself says it's up to date: Version 37.0.2062.120 m

I appreciate the link to Bug 1034124, However the SSL certificate itself IS NOT self signed. Only the CA is, which signed the SSL Cert. I guess what I mean to be asking is... Is Firefox Rejecting my SSL Cert, because my CA Is Self Signed?

I also offer the CA Cert for download since no one would have the cert in their stores. Would this also affect it?

I've attached a screen shot of the error I'm getting so that it's available for the ticket. The following is also the "plaintext" verison of the error I'm getting:

"Certificate type not approved for application."

more options

I finally found a tool online that will show me the guts of the certificate: http://certlogik.com/ssl-checker/phpmyadmin.endofevolution.com/

Everything seems to be good...

more options

Chosen Solution

I discovered the problem: The CA Certificate I was using had extended usage included.

Refer to Bug: 1049176

I confirmed this by generating a new test CA with the the extended usage field excluded, then generating a new SSL Cert The certificate verifies properly now.

While I am relieved I have figured out what the problem is, being so vague with the error message is making me lean towards another browser for primary usage. The fact it took me 4 days and an extremely large amount of work to figure out why this was occurring was unacceptable, all because the error description was generic and included absolutely no details what so ever.

more options

SniperFodder said

I however, do not. It's something specific to Firefox I seem to be having. Maybe I'm running an outdated version of Chrome? Which would be hard seeing as chrome itself says it's up to date: Version 37.0.2062.120 m I appreciate the link to Bug 1034124, However the SSL certificate itself IS NOT self signed. Only the CA is, which signed the SSL Cert. I guess what I mean to be asking is... Is Firefox Rejecting my SSL Cert, because my CA Is Self Signed? I also offer the CA Cert for download since no one would have the cert in their stores. Would this also affect it? I've attached a screen shot of the error I'm getting so that it's available for the ticket. The following is also the "plaintext" verison of the error I'm getting: "Certificate type not approved for application."
more options

I had the same issue, what i did was, copy two cert from your computer 1 is trusted rootCA cert 2.root CA1 from mmc console save those two cert into local computer then import it into mozilla firefox, under options->Advanced-> Certificates->view certificate->authorities->import-> restart it should work

Modified by Brad