Hacker News Reader

Comment by hannob | Hacker News Reader

> The biggest problem I'm having is that our edge firewall doesn't play nicely with it for some reason.[...] I'm not entirely sure how it's working, but I seen a few other people with these issues at the mozilla bug tracker and it's always just sort of either ignored or dismissed.

This sounds like you have some expensive enterprise equipment that is doing funny things with your TLS connection, but instead of complaining to your enterprise vendor that you likely pay a lot of money to, you complain to an open source project that probably has nothing to do with it.

View on HN

I mean that's fair, but it's really frustrating that for whatever reason all the other clients work. I just want to figure out what's going on and how the firewall knows to target firefox. Like I said IT's response is "well who cares just use Chrome".

Try comparing the packet conversation using Wireshark to see if Firefox is doing something different from Chrome.

Someone please correct me if I'm wrong, but I do think Firefox ships their own root certificates with their browser, while Chrome uses the system ones. It's possible fluidcruft's employer has installed new root certificates so they can analyze/inspect the traffic through their network and Chrome is happily rolling along, while Firefox does not like it because now the connection effectively has been broken.

This is most likely exactly what's happening.

On Windows you can choose to use the system store though. On other platforms you can only use the internal one

I 'm pretty confident that shows up as a certificate error with it's own scare page, not connection reset. Usually on cert errors you can click through all the warnings and accept the risks to connect anyway. Connection reset is just a complete dead end.

I have pondered whether there's some way for the firewall to have a whitelist of sites that it allows without SSL MITM and otherwise sends reset for unknown SSL sites unless the firewall's MITM certificates are used. Our IT might be paranoid enough to do that.

I don't have any evidence that the firewall does any MITM other than I found it listed as a feature that can be configured on the firewall's website when I've been googling. But even then the error people complain about is bad cert not connection resets. I have tested with Chrome on systems that IT cannot have injected certificates into and they do work. I do know that I can access my home server's let's encrypt site using firefox and chrome without problems and the keys are correct. So it's not really high in my suspicion list.

Anyway it looks like I need to learn how to packet sniff.

> I 'm pretty confident

Sounds like a engineers way of saying "I think it is like this, but I should double-check just in case" because who knows what the browser can show when something different happens?

I don't know, I would check it at least.

"Connection reset by peer" usually means that either the remote host or an intermediate gateway/firewall sent a TCP RST packet, which is not used during normal connections. Wireshark should help figure this out -- it's a superpower for anyone working in dev or IT.

Huh? If everything but one browser works, the suggestion will be to avoid using that browser unless you can show the expensive equip is doing something wrong.

So firefox doing nothing more than a connection reset message does not help at all.

A trouble ticket that says chrome works, wget works, curl works, IE works, but my firefox browser with 10 privacy plugins does not work - is NOT going to get a good response from you support contact.

So, it sounds like FF is sending something that's causing an RST to be emitted from either the website or (more likely) your appliance. Next step would be to pcap/tcpdump a connection from both a working browser and FF, and see what the difference is. That kind of information is a lot more useful to FF devs than "something is happening that causes an RST from someone".

I was only partly joking about extensions. Definitely disable them all for this testing.

Reply on news.ycombinator.com