Are intermediate certificates cached in Firefox?


Kit Sunde

If someone visits Site A with a GoDaddy-issued certificate that also provides an intermediate certificate between GoDaddy and its CA, then Firefox will cache that intermediate certificate and compare it with a site that also has a GoDaddy-issued certificate but doesn't provide an intermediate certificate B using certificates together? Does it cause the latter case not to generate an SSL error?

The reason I'm asking is that we have SSL issues on 3 of the 13 machines that have a new version of Firefox installed, but I don't think it's issuing an intermediate certificate.

Also, when testing with a fake server and providing the correct certificate settings, the problem goes away when switching back to the real server.

jishi

Better late than never. Yes, browsers will cache intermediate certificates and use them between different sites. So if you're missing an intermediate certificate, random users will get a trust error, but other users won't.

For example, in Firefox it will be cached in a file called cert8.db (in your profile folder). To test this, delete the file manually, or create a new profile in firefox.

Related


Are intermediate certificates cached in Firefox?

Kit Sunde If someone visits Site A with a GoDaddy-issued certificate that also provides an intermediate certificate between GoDaddy and its CA, then Firefox will cache that intermediate certificate and compare it with a site that also has a GoDaddy-issued cert

Install intermediate CA certificates

Harvey I have a Kubernetes cluster hosting my own docker registry built with the following docs : https://github.com/kubernetes/kubernetes/tree/master/cluster/addons/registry and https://github.com/kubernetes/kubernetes /blob/master/cluster/addons/registry/tls

Verify signature without intermediate certificates

Lexicore Is it possible to verify signatures with only ancestor or root certificates in the hierarchy? Disclaimer: I'm new to certificate handling, so please forgive the simplistic terminology. Consider the following situation. We have two parties ( for the id

Verify signature without intermediate certificates

Lexicore Is it possible to verify signatures with only ancestor or root certificates in the hierarchy? Disclaimer: I'm new to certificate handling, so please forgive the simplistic terminology. Consider the following situation. We have two parties ( for the id

Heroku SSL: Install intermediate certificates?

Paul Sanwald My registrar gandi gave me the intermediate certificate to install, so I have 3 files: Private key file (server.key) Certificate file (mycert.crt) Intermediate Certificate (GandiSomething.pem) I am using SSL Beta service on heroku . heroku CLI her

Heroku SSL: Install intermediate certificates?

Paul Sanwald My registrar gandi gave me the intermediate certificate to install, so I have 3 files: Private key file (server.key) Certificate file (mycert.crt) Intermediate Certificate (GandiSomething.pem) I am using SSL Beta service on heroku . heroku CLI her

Verify signature without intermediate certificates

Lexicore Is it possible to verify signatures with only ancestor or root certificates in the hierarchy? Disclaimer: I'm new to certificate handling, so please forgive the simplistic terminology. Consider the following situation. We have two parties ( for the id

Nginx does not provide intermediate certificates

User 1094128 I'm trying to install a ssl certificate on Nginx (Laravel Forge actually). I have connected the certificate with intermediate and there are no errors in the Nginx error log. However, it's not trusted in mobile Chrome - desktop only. Looking at the

Verify signature without intermediate certificates

Lexicore Is it possible to verify signatures with only ancestor or root certificates in the hierarchy? Disclaimer: I'm new to certificate handling, so please forgive the simplistic terminology. Consider the following situation. We have two parties ( for the id

Where is Firefox cached?

SMBiggs With all the recent major changes to Firefox, all information about where it caches is outdated. Or has Firefox changed so much that this issue isn't fixed? Running mac osx 10.6.8 (Snow Leopard). I need to restore some files that are most likely still

Obtain root and intermediate certificates from end entities

uprising: Still new to cryptography, I stumble across something simple every day. Today is just one of those days. I want to validate smime messages in Java using the bouncy castle library, I think I almost got it, but the current problem is the construction o

Chain get all certificates; intermediate and root

Neil Traft: I'm using Apache's HTTPClient in Java and trying to connect to graph.facebook.com. I get the "SSLPeerUnverifiedException: No peer certificate" error, so I guess Facebook's CA is not in the default keystore. So I need to create my own keystore with

Chain get all certificates; intermediate and root

Neil Traft: I'm using Apache's HTTPClient in Java and trying to connect to graph.facebook.com. I get the "SSLPeerUnverifiedException: No peer certificate" error, so I guess Facebook's CA is not in the default keystore. So I need to create my own keystore with

Python SSL server serving intermediate CA certificates

light I'm writing some server code using the Python (2.7) SSL module as follows: ssock = ssl.wrap_socket(sock, ca_certs="all-ca.crt", keyfile="server.key", certfile="server.crt", server_side=True, ssl_version=ssl.PROTOCOL_TLSv1) 'all-ca.crt' contains the signi

Client-Side SSL with Intermediate Certificates

Naftuli Kay I have a self signed root certificate and an intermediate certificate signed by that root. Basically something like this: . └── master (CA) └── servant1 (CA) I have some client certificates from master->servant1certificate chain : . └── master

Obtain root and intermediate certificates from end entities

uprising: Still new to cryptography, I stumble across something simple every day. Today is just one of those days. I want to validate smime messages in Java using the bouncy castle library, I think I almost got it, but the current problem is the construction o

Chain get all certificates; intermediate and root

Neil Traft: I'm using Apache's HTTPClient in Java and trying to connect to graph.facebook.com. I get the "SSLPeerUnverifiedException: No peer certificate" error, so I guess Facebook's CA is not in the default keystore. So I need to create my own keystore with

Python SSL server serving intermediate CA certificates

light I'm writing some server code using the Python (2.7) SSL module as follows: ssock = ssl.wrap_socket(sock, ca_certs="all-ca.crt", keyfile="server.key", certfile="server.crt", server_side=True, ssl_version=ssl.PROTOCOL_TLSv1) 'all-ca.crt' contains the signi

Client-Side SSL with Intermediate Certificates

Naftuli Kay I have a self signed root certificate and an intermediate certificate signed by that root. Basically something like this: . └── master (CA) └── servant1 (CA) I have some client certificates from master->servant1certificate chain : . └── master

What does "intermediate results are being cached" mean?

username I have a set of n vectors stored in a 3 xn matrix . I found out using an external product . When I time it with:znp.einsum %timeit v=np.einsum('i...,j...->ij...',z,z) I got the result: The slowest run took 7.23 times longer than the fastest. This cou

What does "intermediate results are being cached" mean?

username I have a set of n vectors stored in a 3 xn matrix . I found out using an external product . When I time it with:znp.einsum %timeit v=np.einsum('i...,j...->ij...',z,z) I got the result: The slowest run took 7.23 times longer than the fastest. This cou

What does "intermediate results are being cached" mean?

username I have a set of n vectors stored in a 3 xn matrix . I found out using an external product . When I time it with:znp.einsum %timeit v=np.einsum('i...,j...->ij...',z,z) I got the result: The slowest run took 7.23 times longer than the fastest. This cou

What does "intermediate results are being cached" mean?

username I have a set of n vectors stored in a 3 xn matrix . I found out using an external product . When I time it with:znp.einsum %timeit v=np.einsum('i...,j...->ij...',z,z) I got the result: The slowest run took 7.23 times longer than the fastest. This cou

What does "intermediate results are being cached" mean?

username I have a set of n vectors stored in a 3 xn matrix . I found out using an external product . When I time it with:znp.einsum %timeit v=np.einsum('i...,j...->ij...',z,z) I got the result: The slowest run took 7.23 times longer than the fastest. This cou