Google certificate invalid Topic is solved

[Dazed+Confused]

As of half way through this morning I am getting untrusted connection errors when I attempt to use google search.

Technical details show this:
www.google.com uses an invalid security certificate.
The certificate is not trusted because the issuer certificate is unknown.
(Error code: sec_error_unknown_issuer)

Firefox, Vivaldi and Chrome all appear to be working correctly

[satrow]

Welcome

Fine from here (TalkTalk UK), what Pale Moon version, OS and security software?

[Moonchild]

Looks like your typical "https filtering" issue. Check your internet security software/firewall/antivirus settings.

[Dazed+Confused]

Thanks for the prompt replies.

Palemoon version 27.9.2 (64 bit)
Windows 10 Fall update or whatever they called the one last year
Security software is Bullguard

Nothing has changed since it last worked correctly. However, just this instance Thunderbird threw a wobbly over googleapis:443. I had to give it a security exception to allow it to download my google mail.

Disabling Bullguard AV & firewall does not help.

Palemoon on linux (v27.9.0) seems to work fine.

I'm not sure what you mean by 'typical "https filtering" issue.' and I can't see any specific Bullguard options relating to https. I've checked that I have the latest bullguard updates.

Oddly, when I attempt to access https://www.google.com I am solidly blocked. I just tried https://www.google.co.uk and although it claimed that the certificate was invalid (issuer not known) it did allow me to add an exception which means I can now access google via the .co.uk address. The certificate added appears to have been issued by "BullGuard SSL Proxy CA".

[satrow]

Try following the advice here.

[Dazed+Confused]

I've had Bullguard quarantine Palemoon on several occasions, so the advice on how to stop it happening again will be welcome, but in each case I was able to restore from quarantine. The symptoms are also quite different as once quarantined palemoon becomes unusable until action is taken, whereas I only have an issue contacting goole. However, now that I know that the problem may be associated with a Bullguard certificate I will post a query on the Bullguard support forums. I'll post back here if they come up with anything just in case someone else hits the same problem.

[coffeebreak]

I know you tried disabling your AV, but even if only for info, please take a look at this article:

How to troubleshoot the error code "SEC_ERROR_UNKNOWN_ISSUER" on secure websites
(and its section on Bullguard).

[Dazed+Confused]

Thanks coffeebreak, that did it. I'm still confused as to why the problem only manifests in Palemoon and Thunderbird, behaves differently for google.com and google.co.uk and doesn't go away when you disable the AV. Maybe I should have rebooted. Or better still complete my migration to linux!

I'll be interested to see what the Bullguard people say. I'm slowly becoming less enamoured of that product. It seems to be becoming more and more bloated and less and less well organised as time goes on. Unless they come up with something interesting in response to my question I doubt I will renew my subscription when it next comes due.

[coffeebreak]

I'm still confused as to why the problem only manifests in Palemoon and Thunderbird, behaves differently for google.com and google.co.uk and doesn't go away when you disable the AV.

AFAIU, with HTTPS Filtering the AV has to install its own intermediate certificate in the browser. However they tend to install it only in the large mainstream browsers, not in smaller browsers like Pale Moon. (See posts here and here.)

See also:
Why do you recommend not using HTTPS/TLS filtering? (FAQ)
Why do you recommend not using HTTPS/TLS filtering? (Discussion)

[Dazed+Confused]

Well, turning safe browsing off for google fixes the immediate problem. I'm currently working my way through all the material you have provided links to but I suspect I will simply disable the whole kit & caboodle.

For the record Bullguard recommended reinstalling the product to force the certificate to reinstall. However the problem recurred almost immediately so that was not terribly wonderful advice.

[jollyD]

I have found a maybe temporary solution for this...

You will have to Export the BullGuard Certificate from Internet Explorer then Import it to PaleMoon/other web browsers...

Via Control Panel->Internet Options->Content->Certificates->Trusted Root Certification Authorities->Look for "BullGuard"->Tap "Export" as "DER encoded binary x.509(.CER)" and save/name it as "BullGuard" to anywhere you like or to Desktop so you can find it easily... Go to Desktop to check/find the file/certificate named Bullguard.CER.

After that run PaleMoon->Preferences->Advanced->Certificates.. "View Certificates"->Authorities-> then finally select "Import", go to Desktop or where you saved BullGuard.CER, after Importing, find it in the Certificate Manger under Authorities to confirm, select/highlight it, click "Edit Trust", check the box that says "This certificate can identify websites", then ok. ok. ok, lastly exit or restart PaleMoon..

This fix won't only fix Google but other websites aswell like Facebook, Bing, Yahoo, etc. https.

[Moonchild]

The "fix" exporting and importing the certificate doesn't fix the underlying problems with HTTPS/TLS filtering -- see the linked FAQ and discussion.