3

I've been getting a lot of failed connections lately, namely from Facebook and now Google (German site works, French does not). This happened to other sites as well but these two are the kind you expect to work smoothly. Does anyone have a reasonable explanation for this?

I have OCSP validation active on Firefox, i.e. when the OCSP validation fails the certificate is treated as invalid. Additionally, Firefox uses OCSP stapling. An example error below:

Secure Connection Failed

An error occurred during a connection to www.google.fr. The OCSP server experienced an internal error. (Error code: sec_error_ocsp_server_error)

  • The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
  • Please contact the website owners to inform them of this problem. Alternatively, use the command found in the help menu to report this broken site.

Some of the websites where I detected the problem (HTTPS):

  • Facebook;
  • Google France/Spain;
  • Wikipedia; and
  • Youtube.

[Edit] The first time it lasted between 30-60 minutes; and I am still getting this every once in awhile but only at home. At work it rarely happens (different ISP there btw).

Improve this question
5
  • No such warnings on Google Youtube or Facebook here someone must be trying to perform a MiTM attack on you.
    – user36976
    Commented Apr 20, 2014 at 16:34
  • @Nick: Although improbable, I've considered that possibility. If it is happening it's likely to be at an ISP or regional level, and not specifically on me.
    – user3371321
    Commented Apr 20, 2014 at 16:52
  • Would be nice if the down voter explained what is wrong with the question so that I can improve it.
    – user3371321
    Commented May 13, 2014 at 13:12
  • By the way, OCSP stapling can only staple info for one certificate. The browser will still have to contact your intermediate certificates' OCSP servers unless you've recently visited another website using the same ones. (There's an RFC for stapling multiple certs in progress.)
    – Matt Nordhoff
    Commented May 25, 2014 at 2:56
  • make sure the time on your computer is right, mine was 3 am instead of 15:00 so was getting this error
    – user79068
    Commented Jun 20, 2015 at 22:23

4 Answers 4

Reset to default
1

Issue #1: sec_error_ocsp_server_error can occur for other reasons than OCSP server internal error.

From Bugzilla bug 495380:

SEC_ERROR_OCSP_SERVER_ERROR is used 5 times in ocsp.c for everything from an internal OCSP server error to failing create the request session and any number of different problems writing the request to the remote server.`

Issue #2: I believe that Firefox is caching this error but should not do so, so I created Bugzilla bug report 1014979.

Workarounds (from a post that I wrote at another forum):

Method #1: Restart Firefox.

Method #2: Go to Options->Advanced->Certificates-> Validation. Set checkbox "When an OCSP server connection fails, treat the certificate as invalid" to the opposite of what it is now, and then press OK button twice. That is sufficient to clear the OCSP cache. However, since you probably want the original setting that you just changed, go to Options->Advanced->Certificates-> Validation and set checkbox "When an OCSP server connection fails, treat the certificate as invalid" back to the value that was there before you read this post, then press OK button twice.

Improve this answer
1

my solution was to press Ctrl+Shift+R. this reloads the cache on the fly. Its is not a permanent fix. but rather a shortcut for previous solutions

Improve this answer
0

The error message gives you all information you need: what you see is the failure of the OCSP server. Firefox sends request: "is certificate which this site gives me still not revoked?" and OCSP server is overloaded and can not answer

Improve this answer
3
  • Firefox uses OCSP stapling, so it it is (or should be) Google and Wikipedia contacting the OCSP server and not me. Firefox will only contact the OCSP server directly if Google/Wikipedia send me an invalid stapled response or no stapled response at all; and I fail to understand why two major websites would do that. See blog.mozilla.org/security/2013/07/29/ocsp-stapling-in-firefox.
    – user3371321
    Commented May 13, 2014 at 13:05
  • 1
    Wikipedia doesn't use OCSP Stapling: ssllabs.com/ssltest/… Neither does google: ssllabs.com/ssltest/…
    – JimiDini
    Commented May 13, 2014 at 13:54
  • 1
    @user3371321: Firefox supports OCSP stapling. This means that if the server decides to send an OCSP response along with its certificate, Firefox will be able to process it. However, it does not make stapling usage mandatory. Moreover, "major websites" must also support other browsers which do not support stapling, so not-stapled OCSP ought to work as well.
    – Tom Leek
    Commented May 26, 2014 at 17:28
0

The OCSP connection, like standard HTTP connections, made by Firefox may be affected by addons, notably ad blockers.

To verify the issue, take the normal path of disabling the addons, and then once the addon is identified, leave it enabled and disable the ad blocking subscriptions, to narrow the cause. However, each test must be run after a clean restart of Firefox, as OCSP responses are cached including server failures, and there is no way to clear the OCSP cache.

If the failure is do to a broken ad blocker subscription, please then report the fact to the author.

I have personally experienced this issue, had it fixed, and verified the fix.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .