Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    NET::ERR_CERT_AUTHORITY_INVALID

    Scheduled Pinned Locked Moved General pfSense Questions
    42 Posts 5 Posters 8.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • Y
      yogeesh
      last edited by

      I don't know whether its vanilla or not

      2.4.5-RELEASE (amd64)
      built on Tue Mar 24 15:25:50 EDT 2020
      FreeBSD 11.3-STABLE

      The system is on the latest version.
      Version information updated at Thu Apr 2 13:19:58 IST 2020

      1 Reply Last reply Reply Quote 0
      • GertjanG
        Gertjan
        last edited by

        And facebook doesn't work ??????

        Use another PC to test again.

        No "help me" PM's please. Use the forum, the community will thank you.
        Edit : and where are the logs ??

        1 Reply Last reply Reply Quote 0
        • Y
          yogeesh
          last edited by

          yes it is not working
          I have tried in all other PCs

          1 Reply Last reply Reply Quote 0
          • GertjanG
            Gertjan
            last edited by Gertjan

            Applied these advices https://www.facebook.com/notes/protect-the-graph/upgrades-to-facebooks-link-security/2015650322008442/ ?

            edit : and you're using Chrome so for example https://www.thesslstore.com/blog/clear-hsts-settings-chrome-firefox/

            No "help me" PM's please. Use the forum, the community will thank you.
            Edit : and where are the logs ??

            1 Reply Last reply Reply Quote 0
            • Y
              yogeesh
              last edited by

              even if I use safari or any other browser i face the same error.

              IMP: if I switch from the network connection(pfsense bypassed) immediately I am able to access all these websites.
              So I feel this is an issue with pfsense

              GertjanG 1 Reply Last reply Reply Quote 0
              • GertjanG
                Gertjan @yogeesh
                last edited by

                @yogeesh said in NET::ERR_CERT_AUTHORITY_INVALID:

                So I feel this is an issue with pfsense

                I agree.
                Do you agree with this : a detail : your pfSense and mine are the same. The only difference is : your settings and mine.
                Do what do you think : "Install pfSense, and no more facebook.com for your network members". Do you think pfSense would last long ?

                So, what so different with your setup ?

                No "help me" PM's please. Use the forum, the community will thank you.
                Edit : and where are the logs ??

                Y 1 Reply Last reply Reply Quote 1
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator
                  last edited by johnpoz

                  So your running through proxy? Your running through VPN..

                  Out of the box pfsense would have zero to do with your connection..It just routes and nats it, all outbound connections are allowed. I take if you were trying to filter with e2guardian, your running proxy.. Disable that! Does it now work?

                  Running pfsense here, and zero issues with accessing facebook.

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  1 Reply Last reply Reply Quote 0
                  • Y
                    yogeesh @Gertjan
                    last edited by

                    @Gertjan Don't know might be
                    How to verify the setting?

                    1 Reply Last reply Reply Quote 0
                    • GertjanG
                      Gertjan @yogeesh
                      last edited by Gertjan

                      You posted this :

                      @yogeesh said in NET::ERR_CERT_AUTHORITY_INVALID:

                      Re: Unofficial E2guardian package for pfSense

                      Do you know what E2guardian is ?

                      @johnpoz said in NET::ERR_CERT_AUTHORITY_INVALID:

                      Running pfsense here, and zero issues with accessing facebook.

                      Yeah. Lucky you.
                      And that's why I want to know why @yogeesh has issues with this.
                      ( because I'm gonna sell this knowledge as a huge feature )

                      No "help me" PM's please. Use the forum, the community will thank you.
                      Edit : and where are the logs ??

                      1 Reply Last reply Reply Quote 0
                      • Y
                        yogeesh
                        last edited by

                        @Gertjan said in NET::ERR_CERT_AUTHORITY_INVALID:

                        E2guardian is ?

                        No I don't have any idea about E2guardian

                        1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator
                          last edited by johnpoz

                          Well why are you asking about it then???

                          You started this thread with

                          Re: Unofficial E2guardian package for pfSense

                          Look under your package manager - what do you show installed? If you have a proxy setup, disable it!

                          Your in the cache/proxy section - so you have proxy installed... If you have no idea how to run one or troubleshoot one.. Then you should disable it!

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          GertjanG 1 Reply Last reply Reply Quote 0
                          • GertjanG
                            Gertjan @johnpoz
                            last edited by Gertjan

                            @johnpoz said in NET::ERR_CERT_AUTHORITY_INVALID:

                            your package manager

                            Nice catch !!
                            It could be, for example, a pfBlockerNG case, set up with the 'click on all the feeds cause it's free'. That would block facebook for sure, redirected to a pfBlockerNG notification web page, so the wrong cert is being returned and the browser start to yell about HSTS issues.

                            No "help me" PM's please. Use the forum, the community will thank you.
                            Edit : and where are the logs ??

                            1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator
                              last edited by johnpoz

                              Yeah that could be it... But his pic didn't include the address he was going to.. It could be redirection to the 10.10.10.10 address pfblocker uses by default.

                              Oh wait it does just show facebook.com - stupid chrome hiding actual urls!

                              Picture is so small can barely see anything anyway ;)

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              GertjanG 1 Reply Last reply Reply Quote 0
                              • Y
                                yogeesh
                                last edited by

                                Screenshot 2020-03-06 at 1.09.12 PM.png

                                1 Reply Last reply Reply Quote 0
                                • johnpozJ
                                  johnpoz LAYER 8 Global Moderator
                                  last edited by

                                  Show your package manger installed - this page.

                                  package.jpg

                                  Show all the packages you have installed.

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                                  1 Reply Last reply Reply Quote 0
                                  • GertjanG
                                    Gertjan @johnpoz
                                    last edited by Gertjan

                                    @johnpoz said in NET::ERR_CERT_AUTHORITY_INVALID:

                                    stupid chrome hiding actual urls!

                                    That address bar is the best pishing detection tool possible, it will never lie to you, so Google decide to hide it .... Makes me wonder.
                                    Anyway ....

                                    @johnpoz said in NET::ERR_CERT_AUTHORITY_INVALID:

                                    Picture is so small can barely see anything anyway ;)

                                    It's a generic picture we all see. Doesn't contain any useful information except for the error code and the four letter word HSTS. I guess @yogeesh will find out very soon that the only information we have are his words.
                                    Quiet unreadable for use.

                                    I already suggested to use pfSense without any changes in the settings, which include of course packages (none should be used / installed).
                                    The answer was :

                                    @yogeesh said in NET::ERR_CERT_AUTHORITY_INVALID:

                                    I don't know whether its vanilla or not

                                    I guess it's time to ask if there is actually a pilot on that plain ☺

                                    @yogeesh don't worry, the case will get resolved. It will take some time, though.

                                    No "help me" PM's please. Use the forum, the community will thank you.
                                    Edit : and where are the logs ??

                                    1 Reply Last reply Reply Quote 0
                                    • Y
                                      yogeesh
                                      last edited by

                                      Screenshot 2020-04-03 at 12.42.48 PM.png

                                      1 Reply Last reply Reply Quote 0
                                      • johnpozJ
                                        johnpoz LAYER 8 Global Moderator
                                        last edited by johnpoz

                                        Well if you have no packages installed... Then pfsense would not be interfering with any traffic, it just routes/nats it...

                                        Do you have anything setup in port forwards.. Show us your port forwards, and show us your lan rules please.

                                        stuff.jpg

                                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                                        If you get confused: Listen to the Music Play
                                        Please don't Chat/PM me for help, unless mod related
                                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                                        1 Reply Last reply Reply Quote 0
                                        • GertjanG
                                          Gertjan
                                          last edited by Gertjan

                                          Oh.
                                          That's a formal reply !
                                          That removes many possible issues.

                                          Can you tell us what DNS servers you are using ?

                                          734c507a-0af7-4146-9c89-6c4fc1741731-image.png

                                          Do you use the DNS Resolver - and did you chance something in it's settings ?
                                          At the bottom of the ServicesDNS ResolverGeneral Settings page, do you have any overrides :

                                          412459f6-b41b-4e22-9bac-213100dfe867-image.png

                                          Can you resolve www.facebook.com using this :

                                          62fa5adb-79de-4a2e-9bfd-2cfa402d9ce9-image.png

                                          edit : also : Your are using the DHCP Server for your LAN ?

                                          Any settings have been chaged there ?
                                          At the bottom of the page Status > DHCP Leases, all the devices from your LAN(s) are listed ?

                                          On the PC on your LAN, what are the IP settings ?
                                          Type

                                          ipconfig /alll
                                          

                                          to see the gateway, DNS and IP

                                          The gateway and DNS should be the IP of pfSense. By default, 192.168.1.1 the device IP would be something like 192.168.1.101 where 101 can by any number except 0, 1 and 255.

                                          No "help me" PM's please. Use the forum, the community will thank you.
                                          Edit : and where are the logs ??

                                          1 Reply Last reply Reply Quote 1
                                          • johnpozJ
                                            johnpoz LAYER 8 Global Moderator
                                            last edited by

                                            Great questions! All would be good info, maybe someone redirecting facebook.com - I was thinking a port forward to a proxy or something

                                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                                            If you get confused: Listen to the Music Play
                                            Please don't Chat/PM me for help, unless mod related
                                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                                            GertjanG 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.