NET::ERR_CERT_AUTHORITY_INVALID

yogeesh · Apr 3, 2020, 7:34 AM

<mod> removed link to unrelated old thread.. Moving to General</mod>

pl, help in resolving this issue
i feel we have certificate error in pfsense firewall

ashelol2 · Apr 1, 2020, 8:55 PM

This post is deleted!

yogeesh · Apr 2, 2020, 6:00 AM

@yogeesh

Gertjan · Apr 2, 2020, 6:47 AM

You're not posting much details .... So I choose them myself.
Correct me if I'm wrong - and please : give details.

You are using a proxy ?
You are using a web browser that wants to visit www.facebook.com, but some one else gave back a page that wasn't www.facebook.com - This some one is your proxy.

So, easy solution : stop using the proxy and your issue will be over.

The certificate used by www.facebook.com uses HSTS (I leave it up to you to wiki-page up that term) which means : no one can impersonate a sites like www.facebook.com - this "no-one" includes your proxy.

To make a very long story very short : It's 2020 now, and making proxies work has become very difficult. The practice MITM (remember wiki ?) is not allowed by your browser any more - and shutting down that protection has been removed from any browser.

Note that the package "Unofficial E2guardian package for pfSense" is not official, only the author could support it.
Also, note that Marcelloc, the author, isn't very active any more on this forum - last post October 2019. But he is active here https://github.com/e2guardian/e2guardian/issues/567 (just read the official e2guardian support => github. If you can understand what they are talking about over there, then you're the expert - if you don't : well, see my advise above)
I'm not sure if "Unofficial E2guardian" runs well on pfSense 2.4.5.

A known advise is : Proxies can work. They should be installed in front of a firewall device, on ON it.

yogeesh · Apr 2, 2020, 6:54 AM

Hi ,
thanks for your reply
My query is

when i am using network which is bypassed through pf sense to firewall i am unbale to login to facebook or twitter.
but if switch the my network connection to moblie or any other network i can able to access facbook or twiiter.
coming to proxy : No we are not using
pl help in resolving the issue.

Gertjan · Apr 2, 2020, 7:04 AM

@yogeesh said in NET::ERR_CERT_AUTHORITY_INVALID:

Unofficial E2guardian package for pfSense

Then how is your question related to Unofficial E2guardian package for pfSense ?
Why did you also crosspost here https://forum.netgate.com/topic/113757/unofficial-e2guardian-package-for-pfsense/1189 ?

You are aware that a pfSense freshly installed - without modification - permits you to visit any site on the Internet without any restrictions ?
So : speak to your network admin, have him repair your issue !

yogeesh · Apr 2, 2020, 7:07 AM

Hi
I am the network admin here I am unable to trace this.
Previously they have installed pf sense very long back.

Gertjan · Apr 2, 2020, 7:16 AM

In that case you will be able to make it work in less then 5 minutes !!

As said a thousands times already the last week or so, since the outcome of pfSense 2.4.5 :

Backup you settings.
Optional : If possible, backup your VM if you are using a bare-bone system, swap the drive. Tis permits you to go back.
Upgrade to - or even better - install a fresh pfSense 2.4.5.
Make WAN and LAN work.
Done !!

If needed, import your backup up settings back in.
If it fails the,, redo the re install - and do not use your backed up settings any more.
Just set up the minimal needed things and you'll be fine.

Remember, it's a router/firewall : it just takes 10 minutes or so.

yogeesh · Apr 2, 2020, 7:46 AM

Thank you
recently we have performed this but no use

Gertjan · Apr 2, 2020, 7:48 AM

@yogeesh said in NET::ERR_CERT_AUTHORITY_INVALID:

recently we have performed this but no use

What do you mean ?

You installed pfSense 2.4.5 vanilla and no more facebook ?

(which I tend to see as a feature ... )

yogeesh · Apr 2, 2020, 7:51 AM

I don't know whether its vanilla or not

2.4.5-RELEASE (amd64)
built on Tue Mar 24 15:25:50 EDT 2020
FreeBSD 11.3-STABLE

The system is on the latest version.
Version information updated at Thu Apr 2 13:19:58 IST 2020

Gertjan · Apr 2, 2020, 7:55 AM

And facebook doesn't work ??????

Use another PC to test again.

yogeesh · Apr 2, 2020, 7:58 AM

yes it is not working
I have tried in all other PCs

Gertjan · Apr 2, 2020, 8:03 AM

Applied these advices https://www.facebook.com/notes/protect-the-graph/upgrades-to-facebooks-link-security/2015650322008442/ ?

edit : and you're using Chrome so for example https://www.thesslstore.com/blog/clear-hsts-settings-chrome-firefox/

yogeesh · Apr 2, 2020, 1:31 PM

even if I use safari or any other browser i face the same error.

IMP: if I switch from the network connection(pfsense bypassed) immediately I am able to access all these websites.
So I feel this is an issue with pfsense

Gertjan · Apr 2, 2020, 1:31 PM

@yogeesh said in NET::ERR_CERT_AUTHORITY_INVALID:

So I feel this is an issue with pfsense

I agree.
Do you agree with this : a detail : your pfSense and mine are the same. The only difference is : your settings and mine.
Do what do you think : "Install pfSense, and no more facebook.com for your network members". Do you think pfSense would last long ?

So, what so different with your setup ?

johnpoz · Apr 2, 2020, 1:51 PM

So your running through proxy? Your running through VPN..

Out of the box pfsense would have zero to do with your connection..It just routes and nats it, all outbound connections are allowed. I take if you were trying to filter with e2guardian, your running proxy.. Disable that! Does it now work?

Running pfsense here, and zero issues with accessing facebook.