Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    NET::ERR_CERT_AUTHORITY_INVALID

    Scheduled Pinned Locked Moved General pfSense Questions
    42 Posts 5 Posters 8.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • GertjanG
      Gertjan
      last edited by Gertjan

      Applied these advices https://www.facebook.com/notes/protect-the-graph/upgrades-to-facebooks-link-security/2015650322008442/ ?

      edit : and you're using Chrome so for example https://www.thesslstore.com/blog/clear-hsts-settings-chrome-firefox/

      No "help me" PM's please. Use the forum, the community will thank you.
      Edit : and where are the logs ??

      1 Reply Last reply Reply Quote 0
      • Y
        yogeesh
        last edited by

        even if I use safari or any other browser i face the same error.

        IMP: if I switch from the network connection(pfsense bypassed) immediately I am able to access all these websites.
        So I feel this is an issue with pfsense

        GertjanG 1 Reply Last reply Reply Quote 0
        • GertjanG
          Gertjan @yogeesh
          last edited by

          @yogeesh said in NET::ERR_CERT_AUTHORITY_INVALID:

          So I feel this is an issue with pfsense

          I agree.
          Do you agree with this : a detail : your pfSense and mine are the same. The only difference is : your settings and mine.
          Do what do you think : "Install pfSense, and no more facebook.com for your network members". Do you think pfSense would last long ?

          So, what so different with your setup ?

          No "help me" PM's please. Use the forum, the community will thank you.
          Edit : and where are the logs ??

          Y 1 Reply Last reply Reply Quote 1
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by johnpoz

            So your running through proxy? Your running through VPN..

            Out of the box pfsense would have zero to do with your connection..It just routes and nats it, all outbound connections are allowed. I take if you were trying to filter with e2guardian, your running proxy.. Disable that! Does it now work?

            Running pfsense here, and zero issues with accessing facebook.

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            1 Reply Last reply Reply Quote 0
            • Y
              yogeesh @Gertjan
              last edited by

              @Gertjan Don't know might be
              How to verify the setting?

              1 Reply Last reply Reply Quote 0
              • GertjanG
                Gertjan @yogeesh
                last edited by Gertjan

                You posted this :

                @yogeesh said in NET::ERR_CERT_AUTHORITY_INVALID:

                Re: Unofficial E2guardian package for pfSense

                Do you know what E2guardian is ?

                @johnpoz said in NET::ERR_CERT_AUTHORITY_INVALID:

                Running pfsense here, and zero issues with accessing facebook.

                Yeah. Lucky you.
                And that's why I want to know why @yogeesh has issues with this.
                ( because I'm gonna sell this knowledge as a huge feature )

                No "help me" PM's please. Use the forum, the community will thank you.
                Edit : and where are the logs ??

                1 Reply Last reply Reply Quote 0
                • Y
                  yogeesh
                  last edited by

                  @Gertjan said in NET::ERR_CERT_AUTHORITY_INVALID:

                  E2guardian is ?

                  No I don't have any idea about E2guardian

                  1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator
                    last edited by johnpoz

                    Well why are you asking about it then???

                    You started this thread with

                    Re: Unofficial E2guardian package for pfSense

                    Look under your package manager - what do you show installed? If you have a proxy setup, disable it!

                    Your in the cache/proxy section - so you have proxy installed... If you have no idea how to run one or troubleshoot one.. Then you should disable it!

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    GertjanG 1 Reply Last reply Reply Quote 0
                    • GertjanG
                      Gertjan @johnpoz
                      last edited by Gertjan

                      @johnpoz said in NET::ERR_CERT_AUTHORITY_INVALID:

                      your package manager

                      Nice catch !!
                      It could be, for example, a pfBlockerNG case, set up with the 'click on all the feeds cause it's free'. That would block facebook for sure, redirected to a pfBlockerNG notification web page, so the wrong cert is being returned and the browser start to yell about HSTS issues.

                      No "help me" PM's please. Use the forum, the community will thank you.
                      Edit : and where are the logs ??

                      1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator
                        last edited by johnpoz

                        Yeah that could be it... But his pic didn't include the address he was going to.. It could be redirection to the 10.10.10.10 address pfblocker uses by default.

                        Oh wait it does just show facebook.com - stupid chrome hiding actual urls!

                        Picture is so small can barely see anything anyway ;)

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        GertjanG 1 Reply Last reply Reply Quote 0
                        • Y
                          yogeesh
                          last edited by

                          Screenshot 2020-03-06 at 1.09.12 PM.png

                          1 Reply Last reply Reply Quote 0
                          • johnpozJ
                            johnpoz LAYER 8 Global Moderator
                            last edited by

                            Show your package manger installed - this page.

                            package.jpg

                            Show all the packages you have installed.

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                            1 Reply Last reply Reply Quote 0
                            • GertjanG
                              Gertjan @johnpoz
                              last edited by Gertjan

                              @johnpoz said in NET::ERR_CERT_AUTHORITY_INVALID:

                              stupid chrome hiding actual urls!

                              That address bar is the best pishing detection tool possible, it will never lie to you, so Google decide to hide it .... Makes me wonder.
                              Anyway ....

                              @johnpoz said in NET::ERR_CERT_AUTHORITY_INVALID:

                              Picture is so small can barely see anything anyway ;)

                              It's a generic picture we all see. Doesn't contain any useful information except for the error code and the four letter word HSTS. I guess @yogeesh will find out very soon that the only information we have are his words.
                              Quiet unreadable for use.

                              I already suggested to use pfSense without any changes in the settings, which include of course packages (none should be used / installed).
                              The answer was :

                              @yogeesh said in NET::ERR_CERT_AUTHORITY_INVALID:

                              I don't know whether its vanilla or not

                              I guess it's time to ask if there is actually a pilot on that plain ☺

                              @yogeesh don't worry, the case will get resolved. It will take some time, though.

                              No "help me" PM's please. Use the forum, the community will thank you.
                              Edit : and where are the logs ??

                              1 Reply Last reply Reply Quote 0
                              • Y
                                yogeesh
                                last edited by

                                Screenshot 2020-04-03 at 12.42.48 PM.png

                                1 Reply Last reply Reply Quote 0
                                • johnpozJ
                                  johnpoz LAYER 8 Global Moderator
                                  last edited by johnpoz

                                  Well if you have no packages installed... Then pfsense would not be interfering with any traffic, it just routes/nats it...

                                  Do you have anything setup in port forwards.. Show us your port forwards, and show us your lan rules please.

                                  stuff.jpg

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                                  1 Reply Last reply Reply Quote 0
                                  • GertjanG
                                    Gertjan
                                    last edited by Gertjan

                                    Oh.
                                    That's a formal reply !
                                    That removes many possible issues.

                                    Can you tell us what DNS servers you are using ?

                                    734c507a-0af7-4146-9c89-6c4fc1741731-image.png

                                    Do you use the DNS Resolver - and did you chance something in it's settings ?
                                    At the bottom of the ServicesDNS ResolverGeneral Settings page, do you have any overrides :

                                    412459f6-b41b-4e22-9bac-213100dfe867-image.png

                                    Can you resolve www.facebook.com using this :

                                    62fa5adb-79de-4a2e-9bfd-2cfa402d9ce9-image.png

                                    edit : also : Your are using the DHCP Server for your LAN ?

                                    Any settings have been chaged there ?
                                    At the bottom of the page Status > DHCP Leases, all the devices from your LAN(s) are listed ?

                                    On the PC on your LAN, what are the IP settings ?
                                    Type

                                    ipconfig /alll
                                    

                                    to see the gateway, DNS and IP

                                    The gateway and DNS should be the IP of pfSense. By default, 192.168.1.1 the device IP would be something like 192.168.1.101 where 101 can by any number except 0, 1 and 255.

                                    No "help me" PM's please. Use the forum, the community will thank you.
                                    Edit : and where are the logs ??

                                    1 Reply Last reply Reply Quote 1
                                    • johnpozJ
                                      johnpoz LAYER 8 Global Moderator
                                      last edited by

                                      Great questions! All would be good info, maybe someone redirecting facebook.com - I was thinking a port forward to a proxy or something

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                                      GertjanG 1 Reply Last reply Reply Quote 0
                                      • GertjanG
                                        Gertjan @johnpoz
                                        last edited by Gertjan

                                        @johnpoz said in NET::ERR_CERT_AUTHORITY_INVALID:

                                        proxy or something

                                        Might as well forget about the proxy.
                                        He was just posting 'some where'.

                                        It all started here : https://forum.netgate.com/topic/113757/unofficial-e2guardian-package-for-pfsense/1189 post number 1189 using an ancient e2guardian thread. That thread mentions for sure the words "facebook" and "error" and "pfSense" and Google isn't always your friend (they made Chrome, so .... ).

                                        edit @yogeesh : on a windows PC, can you check this file :

                                        C:\Windows\System32\drivers\etc\hosts
                                        

                                        ?

                                        Does it contains "facebook" entries ?

                                        Every possible PC using any OS has this file.
                                        Linux/FreBSD devices have this file here :

                                        /etc/hosts
                                        

                                        No "help me" PM's please. Use the forum, the community will thank you.
                                        Edit : and where are the logs ??

                                        1 Reply Last reply Reply Quote 0
                                        • johnpozJ
                                          johnpoz LAYER 8 Global Moderator
                                          last edited by johnpoz

                                          So should prob remove that stuff from his thread, and move this to general area

                                          edit: edited and moved.

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                                          1 Reply Last reply Reply Quote 0
                                          • Y
                                            yogeesh
                                            last edited by

                                            Screenshot 2020-04-03 at 1.10.55 PM.png Screenshot 2020-04-03 at 1.08.39 PM.png Screenshot 2020-04-03 at 1.07.39 PM.png

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.