Updating Firefox to version 65

[DavidR]

I personally am not seeing this issue with latest FF

Same, although when I go to see site security, it now says it's verified by Avast. And it's like this in every site, it certainly was not like this before

Confirmed no issue.  Not aware that Avast ever stopped verification, but avast forum shows DigiCert, Inc as secure certificate

I have just updated to FF65 on my win10 system with avast free 19.1.2360 and whilst I don't any error as outlined in Reply #2

But the detailed information shows the use of TLS 1.2, I thought things were moving on to TLS 1.3.

[Nidderauer]

Funny thing was, that it did not start immediately after the update, but after a while.

I tried a lot of pages and they all fail, like amazon.de, ebay.de, google.de (I am German as you see ;-))

My wife did some banking in the morning. I came to the running computer and used an open Firefox session.
I WAS on amazon.de. But then, following a link to a product, I got this "This page is not secure" or whatsoever message. From then on all pages failed without exception.

Had to switch off the Web Shield (?), "Web-Schutz" in German to get here...

[Asyn]

Funny thing was, that it did not start immediately after the update, but after a while.

I tried a lot of pages and they all fail, like amazon.de, ebay.de, google.de (I am German as you see ;-))

My wife did some banking in the morning. I came to the running computer and used an open Firefox session.
I WAS on amazon.de. But then, following a link to a product, I got this "This page is not secure" or whatsoever message. From then on all pages failed without exception.

Had to switch off the Web Shield (?), "Web-Schutz" in German to get here...

-> https://forum.avast.com/index.php?topic=224892.0

[Rowan Boatman]

Ugh, this just happened to me.
Everything was working fine and then I restarted Firefox to update it and boom, not secured everywhere.

I toggled the root option in about:config and it did work properly after that, but it seems like from reading up on it this is another issue with Avast and Firefox talking to each other given the webshield thing is also a way to get it working? But it's also somehow only happening to certain unlucky people???

All I want to know is that Avast are aware of this and in contact with Firefox, to the point of something happening about it hah :/

Until then what is the best and safest course of action to deal with this thing, toggling the setting? Turning off web shield seems worse? Any help appreciated

Fully hoping to wake up to a solution, it's late here.

[The Sniggler]

Today's update to Firefox 65 blocking all websites on one machine. Yesterday's update on this machine, so far, so good.
I looked at some of the fixes and think I will wait until Avast and Mozilla figure this out. Pays to wait to upgrade.

[Asyn]

Hi guys, a clean! reinstall of Avast should fix the issue.

[mchain]

I personally am not seeing this issue with latest FF

Same, although when I go to see site security, it now says it's verified by Avast. And it's like this in every site, it certainly was not like this before

Confirmed no issue.  Not aware that Avast ever stopped verification, but avast forum shows DigiCert, Inc as secure certificate

I have just updated to FF65 on my win10 system with avast free 19.1.2360 and whilst I don't any error as outlined in Reply #2

But the detailed information shows the use of TLS 1.2, I thought things were moving on to TLS 1.3.

Confirmed:  TLS 1.2 depreciated from TLS 1.3 setting here a couple of months ago in about:config, manually changed.

[The Sniggler]

Just used the Avast cleanup tool and did a Safe Mode clean install and seems to be OK.

However, I have to say the hassle of a clean install is really unacceptable.

[Asyn]

1. Just used the Avast cleanup tool and did a Safe Mode clean install and seems to be OK.
2. However, I have to say the hassle of a clean install is really unacceptable.

1. OK, thanks for the feedback.
2. Agreed, but it seems only few users run into this, so it's no general problem.

[DavidR]

I personally am not seeing this issue with latest FF

Same, although when I go to see site security, it now says it's verified by Avast. And it's like this in every site, it certainly was not like this before

Confirmed no issue.  Not aware that Avast ever stopped verification, but avast forum shows DigiCert, Inc as secure certificate

I have just updated to FF65 on my win10 system with avast free 19.1.2360 and whilst I don't any error as outlined in Reply #2

But the detailed information shows the use of TLS 1.2, I thought things were moving on to TLS 1.3.

Confirmed:  TLS 1.2 depreciated from TLS 1.3 setting here a couple of months ago in about:config, manually changed.

I don't see anything in about:config (search on TLS) specifically relating to a depreciation to TLS 1.2 (or actually stating the version).

[pdkent2002]

I just posted in mozilla.support.firefox about the two programs not playing "nice" anymore (it happened to me this AM).  I ask for feedback on which kludge is more secure (1) turning off the Avast web shield or (2) changing the value from "false" to "true" on the FF 65 setting: security.enterprise_roots.enabled   Awaiting what I suspect will be an "interesting" bunch of responses! 

[Asyn]

I just posted in mozilla.support.firefox about the two programs not playing "nice" anymore (it happened to me this AM).  I ask for feedback on which kludge is more secure (1) turning off the Avast web shield or (2) changing the value from "false" to "true" on the FF 65 setting: security.enterprise_roots.enabled   Awaiting what I suspect will be an "interesting" bunch of responses!

None, both are workarounds. See Reply #20.

[DavidR]

@ pdkent2002
I think this won't just be impacting Avast/Firefox 65 users, but other AV that attempt to scan https content in firefox 65 for viruses

[RV126]

Hello,

I solved the problem on my computer of "SEC_ERROR_UNKNOWN_ISSUER" and "MOZILLA_PKIX_ERROR_MITM_DETECTED" that appeared after the update of FIREFOX 65.
And leaving the web agent enabled.

I'm going to Firefox Settings.
- Settings
- Privacy and security
- Certificates
- View certificates
- 'Authorities' tab
- Selects the certificate "Avast Web/Mail Shield"
- Change the trust
- Select "This certificate can identify websites" and valid.

And normally it's good. I translated the names of the options from my French version so the names may not be exact.

Best Regards,

[mchain]

I personally am not seeing this issue with latest FF

Same, although when I go to see site security, it now says it's verified by Avast. And it's like this in every site, it certainly was not like this before

Confirmed no issue.  Not aware that Avast ever stopped verification, but avast forum shows DigiCert, Inc as secure certificate

I have just updated to FF65 on my win10 system with avast free 19.1.2360 and whilst I don't any error as outlined in Reply #2

But the detailed information shows the use of TLS 1.2, I thought things were moving on to TLS 1.3.

Confirmed:  TLS 1.2 depreciated from TLS 1.3 setting here a couple of months ago in about:config, manually changed.

I don't see anything in about:config (search on TLS) specifically relating to a depreciation to TLS 1.2 (or actually stating the version).

A Little Troubleshooting:

• I googled TLS settings in Firefox and wound up at a site featuring FF version 49.0!
• See 1st pic below for TLS 1.2 settings
• To move TLS min setting to TLS 1.3 requires Integer value to be changed to (4)
• See 2nd pic below for TLS 1.3 loaded
• Pics 3 and 4 show resulting Secure Connection errors on some sites and include default way of fixing these errors in browser window
• Resetting via 'Restore Default Settings' button fixes the error and resets TLS min value to 3

You should now be able to access web sites as normal. 

TLS min has to be set at value 3.