Linux – SSL https (http secure) sites won’t display is client or server side

arch linuxfirefoxsecurity-warningssl

Oddly, python.org has suddenly become unreachable for me through the Archlinux repo version of Firefox (v27 and v28.0 update):

Secure Connection Failed

An error occurred during a connection to www.python.org. The OCSP
response is not yet valid (contains a date in the future).

(Error code: sec_error_ocsp_future_response)

The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
Please contact the website owners to inform them of this problem. Alternatively, use the command found in the help menu to report this
broken site.

I've read Mozilla site recommends:

  1. Clear cache (or reload not from cache) (ok)
  2. Check your computer's time settings (ok)
  3. Check about:config settings:
    • security.OCSP.enabled = 1 (ok)
    • security.enable_ssl & security.enable_tls
      (I think this last one is outdated, because my version reads security.[some protocol].enable)
  4. Check proxy settings (don't have one)
  5. If you're having trouble with one site, use this checker (passed)

With 65 settings in about:config with the term 'security', I don't even know where to begin turning things on and off. Like what is security.OSCP.GET.enabled=false setting? Sounds like it should be on, but its off. Although I don't have any trouble with logging into my bank's web site.

All points point to python.org having the trouble, but can I be sure? And why the heck is python.org a secure site anyway?

Best Answer

Before anyone blindly turns off that warning by disabling OCSP, double-check that it's really not a client issue. Turning off warning messages is something you only do if you have a VERY GOOD reason and you know what you're doing - or if you are the White House, where "the alarm system had been switched off due to complaints from staff that it was too noisy". However, if you take this issue seriously, you don't do that.

It might simply be that the system clock is slow, because the error message says "contains a date in the future". And it is much more likely that your computer's date/time is incorrect rather than that of the server (that could affect hundreds of clients).

Open a terminal and check your time:

$ date

Restart your NTP service to correct it:

$ sudo systemctl restart ntpd && echo OK

If you don't have the NTP service installed ("not-found" error), install it:

$ sudo pacman -S ntp

Also, make sure it's enabled

$ sudo systemctl is-enabled ntpd || sudo systemctl enable ntpd

With NTP installed and enabled, restart it, give it a couple of seconds to fetch the time and then check the time:

$ sudo systemctl restart ntpd && sleep 30 && date

Then try accessing the website again.

Depending on what desktop environment you use, you may be able to use graphical tools instead of those commands.

And for those who have "fixed" this issue by disabling every security feature until it worked: Please re-enable whatever you have disabled. If you've disabled OCSP, enable it again. Those features are there for a reason.

Related Question