On Mon, 15 Nov 2021 at 08:26:48, Mayayana <mayayana@invalid.nospam>
wrote (my responses usually follow points raised):
>"Lawrence Aracabia" <LawrenceAracabia@Aracabia.com> wrote
>
>| I tried Firefox and it still wouldn't connect to httpS web sites.
>|
>| There seems to be a problem with old "certificates" as only http sites
>| work. The laptop had not been used in probably 10 or 15 years.
>|
>| Is there a way to "check" & "update" the certificates for any given
>| browser?
>
>I updated mine according to this webpage:
>
>https://msfn.org/board/topic/175170-root-certificates-and-revoked-certif
>icates-for-windows-xp/
[]
Will that help with a very old Firefox running on W7? I get quite a lot
of cases where I have to accept the exception (or something like that)
but then it works; in (I think it is) the last week or two, I've had a
few that just won't connect, and don't give me the option to override
the warning.

(I ask because it looks as if it's for Windows rather than Firefox, and
I've heard Firefox uses its own independent certificate store [if that's
the right term].)
--
J. P. Gilliver. UMRA: 1960/<1985 MB++G()AL-IS-Ch++(p)Ar@T+H+Sh0!:`)DNAf

We shall never - never! - allow foreigners to run our economy. They might cure
it. (George Mikes, "How to be Decadent" [1977].)

On Wed, 17 Nov 2021 21:31:20 +0000, "J. P. Gilliver (John)"
<G6JPG@255soft.uk> wrote:

>Will that help with a very old Firefox running on W7? I get quite a lot
>of cases where I have to accept the exception (or something like that)
>but then it works; in (I think it is) the last week or two, I've had a
>few that just won't connect, and don't give me the option to override
>the warning.
>
>(I ask because it looks as if it's for Windows rather than Firefox, and
>I've heard Firefox uses its own independent certificate store [if that's
>the right term].)

Yes, I use three browsers with Windows XP. Opera connects to Twitter,
Firefox doesn't. I use Maxthon for FamilySearch, but it keeps warning
me that Avast has blocked access to a subsidiary site because of an
expired certificate. But Maxthon seems to have DNS trouble. I also use
an older version of Frirefox (v41) but it fails to connect to some
sites too.

--
Steve Hayes from Tshwane, South Africa
Web: http://www.khanya.org.za/stevesig.htm
Blog: http://khanya.wordpress.com
E-mail - see web page, or parse: shayes at dunelm full stop org full stop uk

On Thu, 18 Nov 2021 at 05:53:36, Steve Hayes <hayesstw@telkomsa.net>
wrote (my responses usually follow points raised):
>On Wed, 17 Nov 2021 21:31:20 +0000, "J. P. Gilliver (John)"
><G6JPG@255soft.uk> wrote:
>
>>Will that help with a very old Firefox running on W7? I get quite a lot
[]
>>(I ask because it looks as if it's for Windows rather than Firefox, and
[]
>Yes, I use three browsers with Windows XP. Opera connects to Twitter,
>Firefox doesn't. I use Maxthon for FamilySearch, but it keeps warning
[]
So _will_ the suggested method work for old-F-on-W7?
--
J. P. Gilliver. UMRA: 1960/<1985 MB++G()AL-IS-Ch++(p)Ar@T+H+Sh0!:`)DNAf

One of my tricks as an armchair futurist is to "predict" things that are
already happening and watch people tell me it will never happen.
Scott Adams, 2015-3-9

On Thu, 18 Nov 2021 06:23:27 +0000, "J. P. Gilliver (John)"
<G6JPG@255soft.uk> wrote:

>On Thu, 18 Nov 2021 at 05:53:36, Steve Hayes <hayesstw@telkomsa.net>
>wrote (my responses usually follow points raised):
>>On Wed, 17 Nov 2021 21:31:20 +0000, "J. P. Gilliver (John)"
>><G6JPG@255soft.uk> wrote:
>>
>>>Will that help with a very old Firefox running on W7? I get quite a lot
>[]
>>>(I ask because it looks as if it's for Windows rather than Firefox, and
>[]
>>Yes, I use three browsers with Windows XP. Opera connects to Twitter,
>>Firefox doesn't. I use Maxthon for FamilySearch, but it keeps warning
>[]
>So _will_ the suggested method work for old-F-on-W7?

I think the site owner has to update the certificates.

If your laptop is using W7 you can probably update Firefox, but you
might run into problems because of software bloat -- each update of a
priogram seems to require more memory than the last, and nowadays I
often go and make coffee while waiting for a web site to CLOSE.

--
Steve Hayes from Tshwane, South Africa
Web: http://www.khanya.org.za/stevesig.htm
Blog: http://khanya.wordpress.com
E-mail - see web page, or parse: shayes at dunelm full stop org full stop uk

"J. P. Gilliver (John)" <G6JPG@255soft.uk> wrote

| >I updated mine according to this webpage:
| >
| >https://msfn.org/board/topic/175170-root-certificates-and-revoked-certif
| >icates-for-windows-xp/
| []
| Will that help with a very old Firefox running on W7? I get quite a lot
| of cases where I have to accept the exception (or something like that)
| but then it works; in (I think it is) the last week or two, I've had a
| few that just won't connect, and don't give me the option to override
| the warning.
| | (I ask because it looks as if it's for Windows rather than Firefox, and
| I've heard Firefox uses its own independent certificate store [if that's
| the right term].)

I can't answer that. I came across the cert issue at one point
and did the update. But personally I've never had the problem
of widespread cert rejection that some people talk about.
(FF 52 and New Moon 28) Did the cert update help? I'm afraid I
just don't know. You may be correct that only IE, winhttp, wininet,
and various other system Internet functionality can benefit.

Like you I sometimes get the warnings. There's another trick that
I don't remember offhand to make sure that you get the option
to override. (Firefox gets more daffy all the time.) But you should see
the reason for the warning in that page, too. It's almost always one
of two things:
1) The cert recently expired and hasn't been updated. 2) The cert
is someone else's. In the second case the problem is usually that
MarysMassage.com or EdsHuntingMemorabilia.com are hosted on
CheapHosting.com and their cert is registered to CheapHosting.com,
because getting your own cert is complicated. Firefox then sees
that as a suspicious cert.

Does any of this matter? Not really. If you're going to type in a
credit card number it's important. If you're going to look at photos
of Ed's antique guns then the only risk is that a man in the middle
hack could see the content of the webpage you're visiting. As they
say sometimes in the US but probably not in Britain: Big whoop!

"J. P. Gilliver (John)" wrote:
> On Mon, 15 Nov 2021 at 08:26:48, Mayayana wrote:
>>I updated mine according to this webpage:
>>
>><https://msfn.org/board/topic/175170-root-certificates-and-revoked-certificates-for-windows-xp/>
> []
> Will that help with a very old Firefox running on W7?

No. FF has its own cert store.

> I get quite a lot of cases where I have to accept the exception (or
> something like that) but then it works; in (I think it is) the last
> week or two, I've had a few that just won't connect, and don't give
> me the option to override the warning.

Depending on how old your FF is, it may not support the encryption
algorithm the site wants to use. No amount of updated certs will help
with that and FF won't be able to override. It might be useful if you
could note here which URLs are giving trouble and what version of FF
you're using.

"Apd" <not@all.invalid> wrote

| Depending on how old your FF is, it may not support the encryption
| algorithm the site wants to use.

Why do you think that? TLS 1.3 was added in FF 49. In 52.9
I have security.tls.version.max set to 4 and fallback-limit set
to 3. 1.3 was new 2 years ago. I'm not aware of any TLS 1.4.
Even when the latest isn't supported, sites should use the next
one down. Some sites won't support 1.1, for example.

(The settings add 1 to the level because 1.0 is 1. So 1.2
is 3 and 1.3 is 4.)

I seem to remember that some people were using things like
FF 28. But that still supports 1.2. Anyone who thinks they may have
trouble can check about:config to make sure they're running at
full capacity.

"Mayayana" wrote:
> "Apd" wrote:
>| Depending on how old your FF is, it may not support the encryption
>| algorithm the site wants to use.
>
> Why do you think that?

It's another thing to consider. Each TLS version specifies various
cyphers (cypher suite) that can be used. I don't know what obligation
a server has in the way of full support for all in any given TLS
version or if a browser would implement them all. Perhaps someone can
clarify. I know I've had the odd message that a particular cypher
was not understood (may not have been Firefox).

https://en.wikipedia.org/wiki/Cipher_suite

> TLS 1.3 was added in FF 49. In 52.9
> I have security.tls.version.max set to 4 and fallback-limit set
> to 3. 1.3 was new 2 years ago. I'm not aware of any TLS 1.4.
> Even when the latest isn't supported, sites should use the next
> one down. Some sites won't support 1.1, for example.

Exactly.

> (The settings add 1 to the level because 1.0 is 1. So 1.2
> is 3 and 1.3 is 4.)

The default in FF 52.9 is 3 so I wonder if 1.3 is fully supported.

> I seem to remember that some people were using things like
> FF 28. But that still supports 1.2. Anyone who thinks they may have
> trouble can check about:config to make sure they're running at
> full capacity.

I believe JPG is/was using a very old ver of FF.

"Apd" <not@all.invalid> wrote

|
| > (The settings add 1 to the level because 1.0 is 1. So 1.2
| > is 3 and 1.3 is 4.)
| | The default in FF 52.9 is 3 so I wonder if 1.3 is fully supported.

Look it up. FF 49. The reason it defaults to 3 (TLS 1.2)
is because 4 (1.3) is fairly new and may not be supported
everywhere. The browser is supposed to do a "handshake",
offering what versions it supports, then the server picks the
highest that it supports. So there shouldn't be any problems.
Except possibly with assholes like Google who love to tell you
last week's browser is not sufficient.

Anyone using FF 52 should set the default to 4 (TLS 1.3)
and the fallback to 3. Then all sites should be able to
handle it.

"Mayayana" wrote:
> "Apd" wrote
>| The default in FF 52.9 is 3 so I wonder if 1.3 is fully supported.
>
> Look it up. FF 49.

I have, and before FF 63 they were draft versions. Bugzilla mentioned
some compatability issues but stated "It's fairly safe to flip the
pref if you know what to expect".

> Anyone using FF 52 should set the default to 4 (TLS 1.3)
> and the fallback to 3. Then all sites should be able to
> handle it.

I take it you haven't had problems so I'll try it.

On Fri, 19 Nov 2021 16:17:49 -0000, "Apd" <not@all.invalid> wrote:

>Depending on how old your FF is, it may not support the encryption
>algorithm the site wants to use. No amount of updated certs will help
>with that and FF won't be able to override. It might be useful if you
>could note here which URLs are giving trouble and what version of FF
>you're using.

One that none of my browsers will override is

http://www.oca.org

Firefox reports an expired certificate, and won't override.

Maxthon reports that Avast has blocked it.

Opera does something similar.

Firefox 41 still gets me into Google & Wordpress, and most pages of
GoodReads, other than book description pages, which won't display
properly.

--
Steve Hayes from Tshwane, South Africa
Web: http://www.khanya.org.za/stevesig.htm
Blog: http://khanya.wordpress.com
E-mail - see web page, or parse: shayes at dunelm full stop org full stop uk

On 11/19/2021 9:59 PM, Steve Hayes wrote:
> On Fri, 19 Nov 2021 16:17:49 -0000, "Apd" <not@all.invalid> wrote:
>
>> Depending on how old your FF is, it may not support the encryption
>> algorithm the site wants to use. No amount of updated certs will help
>> with that and FF won't be able to override. It might be useful if you
>> could note here which URLs are giving trouble and what version of FF
>> you're using.
>
> One that none of my browsers will override is
>
> http://www.oca.org
>
> Firefox reports an expired certificate, and won't override.
>
> Maxthon reports that Avast has blocked it.
>
> Opera does something similar.
>
> Firefox 41 still gets me into Google & Wordpress, and most pages of
> GoodReads, other than book description pages, which won't display
> properly.

Sent this link:

https://www.ssllabs.com/ssltest/analyze.html?d=www.oca.org

Five minutes later, the report, a part of which is...

https://www.ssllabs.com/ssltest/analyze.html?d=www.oca.org&s=45.79.144.159 <=== returned result

Mozilla (but the Windows entry is the same)

Path #1: Trusted
1 Sent by server oca.org
Fingerprint SHA256: a72baf3558270f9629b28f5beda73defc54ceddc54d5237ae6b9064644e57cb4
Pin SHA256: I3N6VhKN9Hxzh6f1I2Kq6ZZBtYGbdhMLiED3t8u7NLs=
RSA 2048 bits (e 65537) / SHA256withRSA
2 Sent by server R3
Fingerprint SHA256: 67add1166b020ae61b8f5fc96813c04c2aa589960796865572a3c7e737613dfd
Pin SHA256: jQJTbIh0grw0/1TkHSumWb+Fs0Ggogr621gT3PvPKG0=
RSA 2048 bits (e 65537) / SHA256withRSA
3 In trust store ISRG Root X1 Self-signed
Fingerprint SHA256: 96bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c6
Pin SHA256: C5+lpZ7tcVwmwQIMcRtPbsQtWLABXhQzejna0wHFr8M=
RSA 4096 bits (e 65537) / SHA256withRSA

Path #2: Not trusted (invalid certificate [Fingerprint SHA256:
0687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd6770739])
1 Sent by server oca.org
Fingerprint SHA256: a72baf3558270f9629b28f5beda73defc54ceddc54d5237ae6b9064644e57cb4
Pin SHA256: I3N6VhKN9Hxzh6f1I2Kq6ZZBtYGbdhMLiED3t8u7NLs=
RSA 2048 bits (e 65537) / SHA256withRSA
2 Sent by server R3
Fingerprint SHA256: 67add1166b020ae61b8f5fc96813c04c2aa589960796865572a3c7e737613dfd
Pin SHA256: jQJTbIh0grw0/1TkHSumWb+Fs0Ggogr621gT3PvPKG0=
RSA 2048 bits (e 65537) / SHA256withRSA
3 Sent by server ISRG Root X1
Fingerprint SHA256: 6d99fb265eb1c5b3744765fcbc648f3cd8e1bffafdc4c2f99b9d47cf7ff1c24f
Pin SHA256: C5+lpZ7tcVwmwQIMcRtPbsQtWLABXhQzejna0wHFr8M=
RSA 4096 bits (e 65537) / SHA256withRSA
4 In trust store DST Root CA X3 Self-signed
Fingerprint SHA256: 0687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd6770739
Pin SHA256: Vjs8r4z+80wjNcr1YKepWQboSIRi63WsWXhIMN+eWys=
RSA 2048 bits (e 65537) / SHA1withRSA
Valid until: Thu, 30 Sep 2021 14:01:15 UTC
EXPIRED
Weak or insecure signature, but no impact on root certificate

Which sure looks like the handiwork of LetsEncrypt certificate scheme.
Even though their name isn't mentioned in the listing. I think the
ISRG Root is theirs.

The site gets a grade of "B" because it supports TLS 1.0 and TLS 1.1,
as well as the others. At least it cuts off SSL2 and SSL3. The expired
certificate likely doesn't modify the rating.

Paul

"Steve Hayes" wrote:
> One that none of my browsers will override is
>
> http://www.oca.org
>
> Firefox reports an expired certificate, and won't override.

The site is using certs from LetsEncrypt and there were problems with
them recently. The ones they present to my FF 52.9 are ok. In Paul's
report there is mention of DST Root CA X3 which is now expired. Your
browser should not be trying to use that.

Your browser should be using updated certs from ISRG (LetsEncrypt);
in particular, these should do the job:

- ISRG Root X1 (Self-signed)
- Let's Encrypt R3 (Signed by ISRG Root X1)

Get them from: <https://letsencrypt.org/certificates/> and install
into Firefox. You may also want to install them in WinXP.

> Maxthon reports that Avast has blocked it.
>
> Opera does something similar.

They would also need updating. I don't know if they use in-browser
certs like Firefox or the system ones.

> Firefox 41 still gets me into Google & Wordpress, and most pages of
> GoodReads, other than book description pages, which won't display
> properly.

The most recent Firefox which runs on XP is 52.9 and I don't recall
needing to update its certs.

"Steve Hayes" <hayesstw@telkomsa.net> wrote

| One that none of my browsers will override is
| | http://www.oca.org

Like Apd, it works fine for me in FF 52.9. Why not
update? I know they broke a lot of things, but there
are extensions.

The site is an unholy mess, I must say, for a Christian
organization. :) But that's not uncommon these days.

I'm still having a hard time figuring out why so many
sites are mostly covered with gray in FF. I have to disable
CSS to see them. In some cases it seems to be a deliberate
attempt to block people who don't enable script. They
just plop a full-window DIV with a high z-order on top of
the page, which script then removes. I've been
able to cure some problems by blocking display of those
classes in userContent.css. This particulat site looks like
it's the usual pile-of-crap overuse of script by people using
templates and script snippets who don't know what they're
doing. But the really odd thing is that in IE6 without script
it actually doesn't look too bad!

On Fri, 19 Nov 2021 at 16:17:49, Apd <not@all.invalid> wrote (my
responses usually follow points raised):
>"J. P. Gilliver (John)" wrote:
>> On Mon, 15 Nov 2021 at 08:26:48, Mayayana wrote:
>>>I updated mine according to this webpage:
>>>
>>><https://msfn.org/board/topic/175170-root-certificates-and-revoked-cer
>>>tificates-for-windows-xp/>
>> []
>> Will that help with a very old Firefox running on W7?
>
>No. FF has its own cert store.

I thought I'd read that, so feared as much.
>
>> I get quite a lot of cases where I have to accept the exception (or
>> something like that) but then it works; in (I think it is) the last
>> week or two, I've had a few that just won't connect, and don't give
>> me the option to override the warning.
>
>Depending on how old your FF is, it may not support the encryption
>algorithm the site wants to use. No amount of updated certs will help
>with that and FF won't be able to override. It might be useful if you
>could note here which URLs are giving trouble and what version of FF
>you're using.
>
27.0.1 (which was old even under XP). I'm not worried - I use Chrome
(up-to-date, at least fairly; I'm on Windows 7) for anything FF won't
handle. I just like the UI of this old Firefox, and also on the pages
that _do_ work with it, I think they work faster, though couldn't prove
that. Certainly the equally old version of the DownloadHelper extension
works - and without the slowdown a certain video hosting site has
recently started imposing, too.
>
--
J. P. Gilliver. UMRA: 1960/<1985 MB++G()AL-IS-Ch++(p)Ar@T+H+Sh0!:`)DNAf

<This space unintentionally left blank>.

On Sat, 20 Nov 2021 08:56:03 -0500, "Mayayana"
<mayayana@invalid.nospam> wrote:

>"Steve Hayes" <hayesstw@telkomsa.net> wrote
>
>| One that none of my browsers will override is
>|
>| http://www.oca.org
>
> Like Apd, it works fine for me in FF 52.9. Why not
>update? I know they broke a lot of things, but there
>are extensions.

I was using it, but upgrade to v 41, the bersions before pockets. I
don't want to have to go away and read a chapter of a book while
waiting for a web page to load.

--
Steve Hayes from Tshwane, South Africa
Web: http://www.khanya.org.za/stevesig.htm
Blog: http://khanya.wordpress.com
E-mail - see web page, or parse: shayes at dunelm full stop org full stop uk

"Steve Hayes" <hayesstw@telkomsa.net> wrote

| > Like Apd, it works fine for me in FF 52.9. Why not
| >update? I know they broke a lot of things, but there
| >are extensions.
| | I was using it, but upgrade to v 41, the bersions before pockets. I
| don't want to have to go away and read a chapter of a book while
| waiting for a web page to load.
|

Weird. I never heard of pockets. I had to look it
up. Maybe that was the icon that looks like a few
books, on the toolbar? There are some nonsense
things I always remove, but I never noticed pockets
before. It turns out I had it "enabled", whatever
that means. :)

Firefox is certainly slow and bloated. I like New Moon,
Pale Moon, or Waterfox better. But once FF is started I
find pages generally load instantly. However, I also customize.
I use NoScript to block all script unless I really need it.
I use a HOSTS file to block spyware and ads from 3rd
parties. I don't allow videos to load. I block all prefetching...
So Firefox only needs to load an actual webpage, not 4
MB of javascript software and 19MB of MP4s. I'm still
surprised when I see someone else's computer, with things
jumping all around on webpages. For me, if a webpage
doesn't sit still then something needs to be fixed. But
it's an ongoing battle. Fools who love trinkets are forever
trying to jazz up their pages. I've needed to block CSS display
of :before, :after, transform and animation, in order to block
such things as logos dripping fluorescent green and slideshows
on speed.

On Sun, 21 Nov 2021 08:29:26 -0500, "Mayayana"
<mayayana@invalid.nospam> wrote:

>"Steve Hayes" <hayesstw@telkomsa.net> wrote
>
>| > Like Apd, it works fine for me in FF 52.9. Why not
>| >update? I know they broke a lot of things, but there
>| >are extensions.
>|
>| I was using it, but upgrade to v 41, the bersions before pockets. I
>| don't want to have to go away and read a chapter of a book while
>| waiting for a web page to load.
>|
>
> Weird. I never heard of pockets. I had to look it
>up. Maybe that was the icon that looks like a few
>books, on the toolbar? There are some nonsense
>things I always remove, but I never noticed pockets
>before. It turns out I had it "enabled", whatever
>that means. :)
>
> Firefox is certainly slow and bloated. I like New Moon,
>Pale Moon, or Waterfox better. But once FF is started I
>find pages generally load instantly. However, I also customize.
>I use NoScript to block all script unless I really need it.

Yes, NoScript is the main reason that I still have a version of
Firefox on my computer, and perfer to use it for visiting sites
previously unknown to me, until I know that they can be trusted. I
often make use of the "temporarily allow" feature.

Another thing I like about Firefox with NoScript is that it has the
"Allow cookes for session only" thing, which seems to avoid the "We
value your privacy" messwages.

>I use a HOSTS file to block spyware and ads from 3rd
>parties. I don't allow videos to load. I block all prefetching...
>So Firefox only needs to load an actual webpage, not 4
>MB of javascript software and 19MB of MP4s. I'm still
>surprised when I see someone else's computer, with things
>jumping all around on webpages. For me, if a webpage
>doesn't sit still then something needs to be fixed.

Agreed.

--
Steve Hayes from Tshwane, South Africa
Web: http://www.khanya.org.za/stevesig.htm
Blog: http://khanya.wordpress.com
E-mail - see web page, or parse: shayes at dunelm full stop org full stop uk