Why do I receive a Secure Connection Failed message in Firefox when connecting to a search head which uses a self-signed certificate?

[bpaul_splunk]

I am using self-signed certificates to connect to my search heads using SSL. After upgrading to the latest version of Firefox (31+), I now receive the following error message when trying to connect.

Secure Connection Failed

An error occurred during a connection to x.x.x.x:8000. Issuer certificate is invalid. (Error code: sec_error_ca_cert_invalid)

• The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
• Please contact the website owners to inform them of this problem. Alternatively, use the command found in the help menu to report this broken site.

What needs to be done to enable SSL communication to my search heads?

[Liyra12]

The Secure Connection Failed (sec_error_ca_cert_invalid) message shows up because Firefox no longer accepts self-signed certificates by default. To fix it, you can either add your self-signed certificate into Firefox’s trusted certificates list or turn off the strict check. Open about:config, search for security.use_mozillapkix_verification, and set it to false. Restart Firefox, and you should be able to connect to your search head over SSL without that error. Hope it helps!

[grijhwani]

Is Firefox not prompting you to allow an exception? You should be able to import and trust the search head's certificate into Firefox's trust store, or at the very least allow a permanent exception for that certificate.

[bpaul_splunk]

In this case, there is no option to allow an exception.

[bpaul_splunk]

Mozilla added a new certificate verification feature to their Firefox browser (starting with version 31) called PKIX. You will need to disable this feature to use your own self-signed certificate. You may do the following to accomplish this.

1. Open the Firefox browser.
2. Type about:config in the search bar and press enter.
3. If presented with the warning, “This might void your warranty…”, click the “I’ll be careful, I promise!” button.
4. In the Preference Name column, locate the security.use_mozillapkix_verification option.
5. Double click on the option to toggle the setting to false

You should now be able to use Mozilla Firefox to access your search head using a self-signed certificate. For more information on Mozilla PKIX, please see their blog posting on the subject.