Firefox "Untrusted Connection" warnings when visiting reputable HTTPS sites when using child's account

Question

When using Firefox on Windows, I see an "Untrusted Connection" warning when visiting any HTTPS site, including very reputable ones such as https://www.google.com and https://search.yahoo.com. The warning message says:

Technical Details

search.yahoo.com uses an invalid security certificate.

The certificate is not trusted because no issuer chain was provided.

(Error code: sec_error_unknown_issuer)

This is especially annoying, since the Search Bar doesn't work.

It only seems to happen on a Windows 8.1 child's account with Family Safety enabled. What is going on, and how can I fix it?

Solution 1

Since HTTPS is designed to prevent snooping, Microsoft Family Safety would be unable to monitor the encrypted traffic unless it performs what is essentially a man-in-the-middle attack. It accomplishes this by decrypting and re-encrypting communications using Microsoft's own key. Such tampering, of course, does not go unnoticed. Firefox dutifully reports the man-in-the-middle scheme as suspicious activity.

To consent to such snooping, and suppress all "Untrusted Certificate" warnings arising from this scheme, you need to instruct Firefox to trust Microsoft's SSL certificate that is used for re-encrypting. (Microsoft Internet Explorer doesn't have this "problem" because it trusts Microsoft's certificate out of the box. Google Chrome is the same, since it relies on cryptography mechanisms built into Windows. Firefox, however, uses its own cryptographic routines that consult a separate list of trusted root certificates.)

The certificate that you need to import is Microsoft's. Go to Control Panel → Network and Internet → Internet Options → Content → Certificates → Trusted Root Certification Authorities. Select the Microsoft Family Safety certificate, then click Export…. Answer No, do not export the private key. Either of the two .CER formats is fine. Save it to any convenient temporary location, such as familysafety.cer on your Desktop.

Then, you need to tell Firefox to trust the certificate that you just exported. In the Firefox menu, choose Options → Advanced → Certificates → View Certificates → Authorities → Import…. Select the familysafety.cer that you had just saved. Select Trust this CA to identify websites, then click OK, and close the Options dialog.

You should no longer get the "Untrusted Certificate" warning when visiting reputable, correctly configured websites under Family Safety.

---

Alternatively, you could disable Family Safety, or just the Activity Reporting feature. You can do so under Control Panel → User Accounts and Family Safety → Set up Family Safety for any user. Authenticate as an administrator if necessary, then select the child's account on which to disable the feature.

Solution 2

I also thought this was a problem with my upgrade to Windows 10 but it turned out to be Avast.

If you want to test this,

Avast: Open Avast -> Settings -> Active Protection -> Web Shield (Click Customise) -> Untick Enable HTTPS scanning.

Firefox: Open Firefox, go to say https://www.google.com and see if the page displays.

If you're happy turning off HTTPS scanning when browsing in Firefox then you don't need to do anymore.

...

However if you're concerned and want to get HTTPS scanning working again then you need to enable Firefox to trust Avast's web certificate which modifies content from https sites (such as google) as it checks for potentially harmful content in the secure stream. To achieve this follow these steps,

Windows: Open a run command -> Type mmc and click Ok -> Click File -> Add/Remove Snap-in -> Certificates -> Add -> My User Account -> Finish -> Ok

Expand Certificates - Current User -> Trusted Root Certification Authorities -> Certificates

You should see two certificates for avast!Web/Mail Shield Root, right click on the lower one and choose All Tasks -> Export

In the wizard that appears click Next -> choose DER encoded binary X.509 (.CER) and click Next -> Click Browse and save the file to your desktop using the filename avast.cer -> Click Next -> Click Finish -> You should get a message saying the export was successful

Firefox: Open Firefox -> Click the three horizontal lines and choose Options -> Advanced -> Certificates -> View Certificates -> Import -> Choose avast.cer from your desktop -> Tick the first two boxes and click OK -> OK -> Close Firefox

Avast: Open Avast -> Settings -> Active Protection -> Web Shield (Click Customise) -> Tick Enable HTTPS scanning

Firefox: Open Firefox, go to say https://www.google.com and the page should display

Solution 3

On Windows 10 I had difficulty finding the proper control panel and then the certificate manager, at all. It's been hidden away from the dumbed-down controls UI. The quickest way I found was:

1. Make a shortcut for "Run..." on the start menu: Start > All Apps > W > Windows System > Run > Pin to Start

2. Press your new Run... button and type "certlm.msc"

3. When "Certificates - Local Computer" window appears, Action > Find Certificates... > in the "Contains" box type "Family"

4. Right-click the Microsoft Family Safety certificate and choose "Export..." Now essentially follow the steps from @200_success above; Export the certificate using the defaults (no private key, DER format, save it somewhere convenient).

5. Now for each child on each computer that they use, sign in and import the certificate into Firefox. Firefox > Options > Advanced > Certificates > View Certificates > Authorities tab > Import... and choose the file you saved earlier. Surely there's a way to do this once for all firefox users on a computer?

Solution 4

I know this is an old post, but another answer to this question from my experience was that Avast antivirus did this with any kind of secure connection. Google, Youtube, Steam, or anything else where you see "https:\"

I didn't realize it until I started monitoring the invalid details, and saw Avast as the certificate authority. I uninstalled Avast and went with a different antivirus. That corrected the problem for me.

View more solutions

Comments

[Andrew]

Could your system clock be wrong? Check your date/time. Even though it's HTTPS if your system thinks it's 1/1/2001 and you're loading a certificate 13 years in the future, it won't be valid. Just a thought.

[Tony Schwery]

@Reeves That is not true. (Error code: sec_error_unknown_issuer) which is different from certificate expired.

[Ed Randall]

please add family-safety tag.

[200_success]

@EdRandall 1. Stack Exchange only allows five tags per question. 2. Family safety happens to be part of the answer, but isn't obviously part of the question.

[Xen2050]

So windows has a built-in way to MITM defeat https... I'm sure MS's Internet Explorer would have no trouble trusting MS and give no warning. Good for parents & big brothers I suppose, lol

[phyrfox]

To be fair, it's not "built-in," because you have to install/enable the Family Safety feature first. It's there so parents that wish to monitor and protect their children online can do so.

[dotancohen]

This is a terrific answer. I've starred the question just to reference this answer. Thank you!

[Peteris]

@Xen2050 it's not that it "would have no trouble" in a hypothetical scenario - as the answer states, the out of box IE default configuration already does trust those MS certificates and gives no warning if it's MITM'ed using them somewhere on the way.

[Matthew]

@Xen2050 It would not be if the Family Security CA is a self-signed one.

[Alexander]

If I visit google.com from a Family Safety-enabled computer, and someone (else than Family Safety) drops in on the connection, will I be notified by the browser or not?

[David Z]

@Alexander I don't know exactly how Family Safety works, but from what I understand, it's possible that you would not be notified. Basically, when using the procedure described in the answer, the connection goes from Firefox to Family Safety to Google. Firefox checks (with some caveats) that the connection from it to Family Safety is secure. But it does not, and cannot, check that the connection from Family Safety to Google is secure. Family Safety would have to do that check. I don't know whether it does or not.

[trlkly]

@DavidZ There's a simple test for that. Allow the Family Safety cert and then go to revoked.grc.com, which has a deliberate bad certificate. Honestly, I'd be rather surprised if Family Safety isn't using the Windows certificate store. Designing an app to secure your computer for children but letting them use sites with invalid certificates would be asinine.

[C R]

Mac users can learn how to export the avast certificate here: racf.bnl.gov/docs/howto/grid/osxcertmgmt