Can't access particular page (the12volt.com)

[Axatax]

I haven't been able to access this page (https://www.the12volt.com
) for awhile in Palemoon, while it works in Firefox and Tor Browser (Debian x86). I did contact the site and they don't see anything problematic on their end. This is all the information the browser reports --

Secure Connection Failed

The connection to http://www.the12volt.com was interrupted while the page was loading.

The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
Please contact the website owners to inform them of this problem.

[satrow]

The site is insecure, graded F by Qualys: https://www.ssllabs.com/ssltest/analyze ... 12volt.com

[Axatax]

Thanks. I'm going to link to this thread. I think the site just isn't run by people that are really up on this stuff.

[Moonchild]

Thanks. I'm going to link to this thread. I think the site just isn't run by people that are really up on this stuff.

It's unfortunately a very common problem. Some factions on the Internet have been pushing very hard to get as many people and sites on https instead of http as possible, while it really doesn't make sense to do so (and has some serious drawbacks for the general health and neutrality of the Internet as a whole). As such, many webmasters have felt compelled to set up secure servers for public information, often without the required knowledge or expertise to do so properly.
As a result, a lot of sites have broken due to incorrect https setups. You can't reallt fault the webmasters for it; ultimately it's the https pushers and "encrypt everything always" fanatics who are to blame, IMNSHO.

(That being said, anyone still running IIS 6.0 in 2019 should be slapped with a large trout until they see the light).

[aveinc]

I have a web server that I use https on primarily. This is a development machine running FreeBSD, Apache24 and runs on both an internal network (ie 10.0.1.x), two external ipv4 network dns names (same ipv4 addr) and an ipv6 network.

I have self signed certs for the https pages as I do believe encrypted traffic to be useful.

The main cert is obtained from let's encrypt, and prior to that another provider. I cannot and will not pay "trusted CA" sites which cannot be properly vouched for, have, in the past leaked cert data, and whose vulnerability cannot be determined by us. As I do not use financial data or transactions and use trusted secured email services (protonmail.ch and pgp) for mission critical transmitted data. Since this particular server is used for development, it has a variety of access points which all redirect to a common https point of entry.

I know the risks and problems with overriding a minor cert error, or an error or known causes and accept them, with respect to this particular server anyway since I can walk out to my garage and touch it and the server in question is jailed.

So, for all these reasons, please tell us how to override the CA-cert errors Palemoon enforces. Thank you.

[aveinc]

One other comment from the Mozilla forum on this issue courtesy of bbs user xfosda on 10/6/2018.

I've spent the day switching over to Edge - not because I want to but because I find myself shut out of practically every other site I try to access with Firefox. It is not my responsibility to inform the owners of all the world's sites that they should update their security to fall into line with Mozilla's requirements. I do not have the power to do this. All I - and every other Firefox user - can do is change my browser. Please restore Firefox to a workable, usable state.

Substitute Palemoon/Newmoon for Firefox in the above, and it pretty much describes what we, the users are and are not empowered to do. I left FF because of the course they began plotting and moved to PM/NM, as I truly believe that we should have alternatives to IE and Safari, but the tools have to be usable or configurable so they can be used for those of us who care about security but not in the way the browser big brothers want us to.

[Frasier]

I do believe encrypted traffic to be useful.

How is encrypted traffic useful if the cert errors are just going to be ignored? In this particular instance, I would not term this as a 'minor cert error.' Did you follow satrow's link?

[RJARRRPCGP]

That error message isn't a usual cert error message, it means that PaleMoon disconnected because of the server using an obsolete encryption standard. In this case, SSL 2! SSL 2 is grossly vulnerable!

[aveinc]

I do believe encrypted traffic to be useful.

How is encrypted traffic useful if the cert errors are just going to be ignored? In this particular instance, I would not term this as a 'minor cert error.' Did you follow satrow's link?

Just to be clear, I am not talking about the site as posted by the OP. The OP's question does raise a broader question, and since my concern and reason for coming to the forum concerns the same behavior I didn't think it productive to open a new topic, which may be my bad. That being said, the broader question remains: Is it appropriate for browser code to have the final say on whether (or not) a user can look at a web site? This is the crux of the matter.

Encrypted traffic from unknown sites over which the user does not have control or internal knowledge should, as you state, be suspect. This is a good reason to have browser warnings and to cause the user to question the web site they are attempting to access. These warnings should not be ignored. But, once the reason for the error is known and identified, then with informed consent, if users wish to proceed, then be it on their heads and not an authoritarian browser.

In the above referenced situation, I own the web site, I program the web site and I know its every internal working. It is mainly for internal development and rarely is used on the internet at large except when I go to my favorite watering hole for lunch and want to keep on working or do a presentation at a meeting. In this case, I am the sole user, and I really don't care if anyone else in the world wants to look at the information on the server, and I know why the cert fails. So, I ask a simple thing: let me tell my browser to override what would be unwise in the broader world.

This site runs FreeBSD-R12 which does not use SSL v2 it uses TLS and supports TLS 1.3. The problem is in the apache config files because I only have but one public facing <Virtual Host> defined. And I only got one or two certs from LetsEncrypt. As it is a playground, I access it from my internal nets, which being a development system and network architecture, changes from time to time. If I were to change the Apache config files every time I dinked with a network router it would increase the time it takes to test new or novel approaches to solving problems, like using IPV6.

I came to NewMoon because mozilla decided to be thought/developmental/access police and all around big brother. These draconian moves by Mozilla forced out a cert maker in Australian and forced a lot of people to either pay danegeld to the Verisigns of the world or drop https altogether. That's fine if you're ebay or amazon, but not so fine if you're an R&D firm on the fringes or a hobbyist.

I think all people are asking is this: If I determine it is ok to proceed to a website that is protected by possibly flawed https then let me do it, even if the bonehead (in this case me) who set it up didn't do it perfectly, then let me instruct my browser to do just that. Otherwise, we will have to go to Chrome and let Google/Alphabet be evermore snoopy in our affairs. Is that so much to ask?

PS.

Did you follow satrow's link?

Yes I did. I ran my own webserver against the link. (Not the one in the OP, which gave rise to this thread.) It passed with a B on its main public facing page, the B only because of the Forward Key exchange issue and the fact that I didn't set the browser to prefer ECDHE. I have modified my server and all is good for now. But I maintain that browsers should not censure websites. Users should be warned, but have the final say.

[Frasier]

Perhaps you should install Pale Moon Commander Advanced preferences for Pale Moon.

[GigaWatt]

I only have one question for aveinc: Why, oh WHY, did you even consider using SSL when the site was for your own personal use or as a hobby?

[therube]

I have only one question , is there a Pref, albeit unsafe, that can be switched that would allow access to the12volt.com or to this personal server or are the particular cyphers (?) simply not included in PM to allow this?

[coffeebreak]

is there a Pref, albeit unsafe, that can be switched that would allow access...

This FAQ points to some options: Secure connection errors? **READ THIS FIRST!**
(and see also here)

[therube]

Ah, OK, that's got it.
Thanks.

A bit convoluted, but I guess its purposely that way, to thwart one from making the changes - unless you really want to make the changes.
(Before, I simply farted around in about config, enabling various cyphers, & it was probably the fallback hosts pref, which I knew nothing of, that I was actually missing.)