certificate exceptions

Not sure if I am explaining this correctly.  I am the middle man.  Going to a website with firefox and it comes up with a certificate that needs to be added for this website.  I add the exception/certificate and it works until the next time I go in there or go to another area of the website.  Then it asks again.  Any ideas?
mkramer777Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Dave HoweSoftware and Hardware EngineerCommented:
Depends which mitm solution you are using, but usually you have to add the issuing CA cert from the appliance into the root store of firefox; the solutions usually push that for IE with group policy,  but firefox has its own keystore (options> advanced)
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
mkramer777Author Commented:
Not sure what mitm is?
0
McKnifeCommented:
mitm=man in the middle... that was not what you meant by calling yourself a "middle man", I assume.
Please describe how you store the exception in firefox and, if possible, name the website and firefox version.
0
Dave HoweSoftware and Hardware EngineerCommented:
I may have misunderstood.

  MitM is a specific term in networking (and in cryptography, but we can put that aside for now) - It is commonly met where you have a DLP appliance (such as Cisco Ironport) that acts as a proxy for web browsers, and replaces the genuine certificate with its own one so that it can look "inside" https, which is otherwise impossible.

  Ok, now FIrefox does have the above issue with certain sites (chiefly linkedin and google) if you have certain plugins, *or* if access to intermediate certificates is blocked.

  The latter is because, for many sites, the signing certificate is *not* the root certificate. you have instead:

[CA Root] <-- stored in firefox
      |
[Intermediate] <-- stored on web, have to pull using http(s)
      |
[website] <-- what your browser sees, contains URL of Intermediate so it can be fetched

  If you are doing permissive-only blocking (a proxy that only allows access to a specified list of websites) you often find that you must add the addresses of the Intermediates to the list, or verification will fail.  If this is the issue, then look in the certificate (and usefully, firefox will offer to show you this each time) and look for the "Authority Information Access" field in the certificate. That shows you where the browser will attempt to pull the intermediate from.

  Otherwise, as McKnife says, we are going to need more info from you (an example of a website with this problem, and version of firefox) to help further.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Web Browsers

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.