Windows 11 doesn't like SSl Certs

Jarhead

Anyone else having problems with existing ssl certificates with Win 11 in the past week?
All of my pfSense boxes, and even some NAS boxes I have no longer have valid certs.
This happened in the past week so I'm guessing it's related to a windows update.
I even tried creating a new self signed cert in pfSense and it doesn't like it either.

jimp

No problems here. What is the specific error it's throwing? Is your system clock accurate (especially the date)?

johnpoz

@jarhead said in Windows 11 doesn't like SSl Certs:

no longer have valid certs.

And why does it say they are not valid? Should throw a reason, date not valid, CA not trusted, etc.

bingo600

Hopefully they're not making an "Apple" on the Cert lifetime.

/Bingo

SteveITS

@jarhead What browser, and what is the error? Did you try another browser? If Chrome, one of our staff ran into an issue several months ago on our pfSense routers where it was flagging the connection/cert with a specific error. Other PCs and/or other browsers didn't see it. I vaguely recall it was inconsistent? He's on vacation for the next 10 days though.

We eventually found there is a secret word to type into the web page (I kid you not) that allows the connection. Ah I think I found it:

https://support.google.com/chrome/thread/10551759/net-err-cert-invalid-website-sent-scrambled-credentials-self-signed-certificate?hl=en&msgid=31644104
"A quick way to bypass this message — open Advanced and see if you have a “proceed to website” option.

IF NOT, you can try typing “badidea” or “thisisunsafe” directly in chrome on the same page. Don’t do this unless the site is one you trust or develop. The text “badidea” and “thisisunsafe” says a lot!"

I don't remember if that was the error (NET::ERR_CERT_INVALID website sent scrambled credentials) but that was the "solution." Reissuing the self-signed cert, etc. didn't help.

Jarhead

All the errors were the same, not trusted.
I ended up deleting all the certs and reinstalling all of them by downloading from each pfSense box and now they're fine again.
Not sure what happened but happy it's fixed!