No section for Forum Issues; heidi

phkhgh

Member
There's no section to post questions on forum issues, so I'll put it here.
When using the https://eraser.heidi.ie/forum/ , Firefox reports a certificate error. The secure connection URL is the one sent in email notifications of forum replies. Does Heidi keep this certificate updated?

eraser.heidi.ie uses an invalid security certificate.

The certificate is not trusted because no issuer chain was provided.

(Error code: sec_error_unknown_issuer)
 
This is the correct forum. Unfortunately, I don't know what the cause of your problem is; I have never had any problems accessing the Eraser site with Firefox, which is my default browser and is fully updated.

David
 
Thanks David. Not sure we're on same page.

When I receive email notifications, this is the link contained to view the topic:
https://eraser.heidi.ie/forum/viewtopic.php<forum or topic id>

When follow the link from email, for Beta forum
If you want to view the topic, click the following link:
https://eraser.heidi.ie/forum/viewtopic.php?f=36&t=8739
I get the error in Firefox on SECURITY CERTIFICATE, not an error about reaching eraser.heidi.ie (non secure connection), per se.

If there is an SSL connection that exists to the forums, FF isn't recognizing their certificate as valid (or it's a problem & the FF msg doesn't correspond to the real issue).
If a secure url to Eraser forums doesn't exist, need to change email notification links.

If secure connection DOES exist & certificate isn't valid / up to date, need to address that.

If it's a FF prob., I need to figure out what that is.
 
Sorry; must have expressed myself badly. I understand your point, and confirm that I can follow forum links in FF without getting any kind of error.

It's not my area of expertise, but I wonder if this link might help?

David
 
Thanks David. You can access the SECURE https forum URL? It's possible you have some diff settings in FF prefs than me, for security settings.
Thanks for the link. I understand about over riding the security warning on certs. The "tutorial" on that link is a bit misleading (for those not very familiar w/ site security certificates).

1st, it says, "Now click on the Add Exception. You will see the following screen." (Exception being the operative word)
Then it says, "Here add the site you want to get the certificate to. Then click on get certificate. Firefox will check for the certificate and show it.

Firefox is NOT checking a site for a new, valid certificate on these screens / process. It's simply allowing users to over ride FF's warning that the site certif. has something wrong w/ it.

Do I trust Heidi Forums? Sure. That doesn't mean their certificate doesn't need attention (maybe expired, etc.). It also does NOT mean that (as FF warns) someone hasn't maliciously tampered w/ the connection. In this case, FF is reporting (in details) that Heidi cert's chain of authority is incomplete (which it is, looking at the actual certificate).

Out of all the similar warnings I got for sites I often use, then suddenly get a warning, 98% of the times I've checked w/ the company / webmaster, there WAS a problem w/ the certificate. Usually, the webmaster / IT dept. was "aware & working to fix it." Some of these are BANKS that let their certs expire, etc.

If you are accessing the httpS:// url & getting no warning, then there may be a prob w/ my FF or we have diff prefs settings, - who knows. But I RARELY get such warnings from reputable sites, where there is NOT an actual prob. w/ the cert. So, dunno answer for this one - yet.
 
I said that this was not my area of expertise, and you have just proved it. Doing exactly what you do, I now get the same results.

How far this matters, I don't know. I don't have any dealings with the Heidi site that I would want to be secure. Equally, we would all want it to be locked down from tampering, but I think that quite a lot has been done in that direction. Only Garrett (admin) can, I think, advise on this.

David
 
I've got a SSL cert installed on the server, BUT I'm not publicising it because the SSL cert is mainly used for administrative purposes. I don't know why the forum wants to send out https:// in the emails, but in any case I've fixed it last week.

In other words... if you want to use HTTPS to access the forum, by all means go ahead, but I'm not intending to support that "feature."
 
Back
Top