NET::ERR_CERT_AUTHORITY_INVALID

[yogeesh]

[johnpoz]

;; QUESTION SECTION:
;106.61.112.146.in-addr.arpa.   IN      PTR

;; ANSWER SECTION:
106.61.112.146.in-addr.arpa. 3600 IN    PTR     hit-adult.opendns.com.

looks like being blocked as adult in opendns!

Would explain why when not using pfsense works, because not using opendns..

[Gertjan]

@johnpoz said in NET::ERR_CERT_AUTHORITY_INVALID:

adult in opendns!

So, DNS isn't being done by pfSense, but relayed to opendns.
Using default pfSense settings would probably have solved the issue right away.

I have an account with OpenDNS, so I tested. Activated the "adult" level.

I visited https://www.facebook.com and ..................

Case closed ^^

[johnpoz]

Yup closed - finally!

Is it really an adult-hit for facebook, or is a timewaster hit? The ptr on that IP returned say adult hit.. hehehehe

[Gertjan]

Exact.
I somehow remembered that DNS IP - I've been playing with OpenDNS, as they offer a useful service for home type installation with 'clients' that are kids that need be be checked upon.
When I saw the setting 'High' blocking social media, I decided to test it myself.

But all this isn't a pfSense issue.
It's just OpenDNS, installed, activated by the admin of pfSense, doing what it is told to do.

And black holing sites like facebook is triggering the MITM/HSTS browser protection.

[johnpoz]

To be honest there are actually very few actual pfsense issues.. Most are layer 8 issues.. misconfig. Which this is for sure. Configuration set without understand what that could mean, and how to troubleshoot it.. Only reason this took so long is lack of information.

[yogeesh]

I didn't understand
help me

[Gertjan]

Ok,

First do this : https://docs.netgate.com/pfsense/en/latest/backup/configuration-backup-and-restore.html
Then do this : https://docs.netgate.com/pfsense/en/latest/config/factory-defaults.html

Last step : use this https://docs.netgate.com/pfsense/en/latest/book/interfaces/ipv4-wan-types.html to activate your Internet access.

Do not change anything else. Not now, not later.

You'll be safe.
You'll be having access to the internet, facebook.com included.

[yogeesh]

Thank you for reply
i will try this and update you on this.

[hardeep0607]

@yogeesh said in NET::ERR_CERT_AUTHORITY_INVALID:

eel we have certificate error in pfsense firewall

And to fix NET::ERR_CERT_AUTHORITY_INVALID error try the below given fixes one by one:
• Reload the Pages
• And clear the cache and cookies of Opera browser
• Allocate the DNS settings
• Try to clear the computer’s SSL state
• You can use the free SSL check tool like Qualys SSL Labs, to run an SSL Server Test.
• Check if you are running an antivirus then disable the third party antivirus.
Hope the steps given works for you to fix NET::ERR_CERT_AUTHORITY_INVALID error.