{"id":4036,"date":"2021-12-16T19:25:51","date_gmt":"2021-12-16T13:55:51","guid":{"rendered":"https:\/\/xiarch.com\/blog\/?p=4036"},"modified":"2021-12-16T19:25:56","modified_gmt":"2021-12-16T13:55:56","slug":"what-to-do-when-firefox-users-cant-reach-microsoft-com","status":"publish","type":"post","link":"https:\/\/xiarch.com\/blog\/what-to-do-when-firefox-users-cant-reach-microsoft-com\/","title":{"rendered":"What to do When Firefox users can’t reach Microsoft.com?"},"content":{"rendered":"\n

Those operating the Mozilla Firefox web browser are left incapable to access microsoft.com and its subdomains this week. Tests by our experts ensure the issue relates to SSL certificate validation errors. Below we explain what you can do to remedy the issue.<\/p><\/p>\n\n\n\n

Firefox: ‘Secure Connection Failed’ to Microsoft.com<\/strong><\/h2>\n\n\n\n

When using Firefox, accessing microsoft.com is not working quite as expected for many around the world. To confirm, our experts conducted tests on both Firefox 93.0 and the latest version 95.0 (64-bit) on a macOS BigSur 11.6 device.<\/p><\/p>\n\n\n\n

\"What-to-do-when-Firefox-users-can't-reach-Microsoft.com-image1\"<\/figure><\/div>\n\n\n\n

Surely enough, on both versions of Firefox, navigating to https:\/\/www.microsoft.com\/ throws a ‘Secure Connection Failed’ error:<\/p><\/p>\n\n\n\n

\"What-to-do-When-Firefox-users-can't-reach-Microsoft.com-image2<\/figure><\/div>\n\n\n\n

Earlier this week, reports of Firefox users unable to access select Microsoft subdomains also emerged. These included docs.microsoft.com, answers.microsoft.com, and visualstudio.microsoft.com, among others.<\/p><\/p>\n\n\n\n

Xiarch is unable to reproduce the connection issues on all of these subdomains, but we could not connect to developer.microsoft.com, and partner.microsoft.com, at the time of writing. It is also possible the error only appears on some but not all attempts due to multiple nameservers associated with each domain.<\/p><\/p>\n\n\n\n

Apparently, the SSL certificate presented by microsoft.com and its subdomains is not good enough for Firefox\u2014we had no issues accessing the tech giant’s websites on Google Chrome and Safari.<\/p><\/p>\n\n\n\n

Specifically, the error code ‘MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING’ and the message “The OCSP answer does not include a class for the certificate being verified,” help trace down the cause of the issue. The Online Certificate Status Protocol (OCSP) is a way for browsers and other client-side applications to check if an SSL certificate has been revoked, as an option to relying on traditional revocation lists.<\/p><\/p>\n\n\n\n

When offered with an SSL certificate, client-side applications can connect to the certificate authority (CA) to verify its revocation status. The error, however, stems from a concept known as OCSP stapling.<\/p><\/p>\n\n\n\n

OCSP stapling is a means to improve on the original OCSP standard by eliminating the need for client-side applications to query CA servers for checking a certificate’s status. This decreases the cost associated with making an extra lookup and improves the overall performance and security.<\/p><\/p>\n\n\n\n

Instead of the client-side application having to make one more request to the CA server to validate the X.509 certificate presented by a website, the website itself makes periodic requests to the CA and retrieves an ephemerally valid signed ‘proof’ of the certificate’s validity.<\/p><\/p>\n\n\n\n

The certificates presented to client-side apps come appended with this signed time-stamped response that can be trivially verified by the client-side application to ascertain the certificate’s status.<\/p><\/p>\n\n\n\n

\"What-to-do-When-Firefox-users-can't-reach-Microsoft.com-image3\"<\/figure><\/div>\n\n\n\n

If ‘OCSP stapling’ is enabled on an application, such as a web browser, the application can decide whether terminate the secure connection for certificates deemed invalid, based on the response attached to the certificate.<\/p><\/p>\n\n\n\n

Or, as Mozilla’s Dana Keeler explains it:<\/p><\/p>\n\n\n\n

OCSP stapling solves these problems by having the site itself periodically ask the CA for a signed assertion of status and sending that statement in the handshake at the beginning of new HTTPS connections. The browser takes that signed, stapled response, verifies it, and uses it to determine if the site\u2019s certificate is still trustworthy. If not, it knows that something is wrong and it must terminate the connection. Otherwise, the certificate is fine and the user can connect to the site.<\/p><\/p>\n\n\n\n

But, if Microsoft.com’s SSL certificate is otherwise valid, according to Chrome and Safari, why won’t Firefox accept it?<\/p><\/p>\n\n\n\n

An 8-year-old bug to blame?<\/p><\/p>\n\n\n\n

It seems that an 8-year bug in Firefox, or a missing feature, is to blame for the issue. Firefox did not yet recognize the SHA-2 family of hashes, such as SHA-256, in the CertID fields that are present in OCSP responses it receives.<\/p><\/p>\n\n\n\n

\"What-to-do-When-Firefox-users-can't-reach-Microsoft.com-image4<\/figure><\/div>\n\n\n\n

What can Firefox users do in the meantime?<\/strong><\/h3>\n\n\n\n

A quick workaround to remediate the connection issues is to temporarily disable OCSP stapling in Firefox, as confirmed by our experts.<\/p><\/p>\n\n\n\n

  • To do so, Firefox users should type about: config in their address bar and hit Enter or Return.<\/li>
  • You will then need to click the ‘Accept the Risk and Continue’ button, following the Proceed with a Caution warning message.<\/li>
  • In the ‘Search preference name’ text box, type “stapl” (no ‘e’ at the end), and the following two settings should show up:<\/li><\/ul>\n\n\n\n
    1. security.ssl.enable_ocsp_must_staple true<\/li>
    2. security.ssl.enable_ocsp_stapling true<\/li><\/ol>\n\n\n\n
      • Double-click on each of these settings to toggle these to ‘false’<\/li><\/ul>\n\n\n\n

        Once Firefox does release an update to address the cause, navigate to about: config following the aforementioned steps to set OCSP stapling to ‘true’ once again for a secure browsing experience.<\/p><\/p>\n","protected":false},"excerpt":{"rendered":"

        Those operating the Mozilla Firefox web browser are left incapable to access microsoft.com and its subdomains this week. Tests by our experts ensure the issue relates to SSL certificate validation errors. Below we explain what you can do to remedy the issue. Firefox: ‘Secure Connection Failed’ to Microsoft.com When using Firefox, accessing microsoft.com is not […]<\/p>\n","protected":false},"author":2,"featured_media":4038,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[6],"tags":[],"yoast_head":"\nWhat to do When Firefox users can't reach Microsoft.com? - Xiarch Solutions Private Limited<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/xiarch.com\/blog\/what-to-do-when-firefox-users-cant-reach-microsoft-com\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"What to do When Firefox users can't reach Microsoft.com? - Xiarch Solutions Private Limited\" \/>\n<meta property=\"og:description\" content=\"Those operating the Mozilla Firefox web browser are left incapable to access microsoft.com and its subdomains this week. Tests by our experts ensure the issue relates to SSL certificate validation errors. Below we explain what you can do to remedy the issue. Firefox: ‘Secure Connection Failed’ to Microsoft.com When using Firefox, accessing microsoft.com is not […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/xiarch.com\/blog\/what-to-do-when-firefox-users-cant-reach-microsoft-com\/\" \/>\n<meta property=\"og:site_name\" content=\"Xiarch Solutions Private Limited\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/xiarch\/\" \/>\n<meta property=\"article:published_time\" content=\"2021-12-16T13:55:51+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-12-16T13:55:56+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/12\/What-to-do-when-Firefox-users-cant-reach-Microsoft.com-featured-image.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1000\" \/>\n\t<meta property=\"og:image:height\" content=\"524\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Xiarch Security\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@xiarch\" \/>\n<meta name=\"twitter:site\" content=\"@xiarch\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Xiarch Security\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/xiarch.com\/blog\/what-to-do-when-firefox-users-cant-reach-microsoft-com\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/xiarch.com\/blog\/what-to-do-when-firefox-users-cant-reach-microsoft-com\/\"},\"author\":{\"name\":\"Xiarch Security\",\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/person\/655d814a04eacce56942270cfdc5c59c\"},\"headline\":\"What to do When Firefox users can’t reach Microsoft.com?\",\"datePublished\":\"2021-12-16T13:55:51+00:00\",\"dateModified\":\"2021-12-16T13:55:56+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/xiarch.com\/blog\/what-to-do-when-firefox-users-cant-reach-microsoft-com\/\"},\"wordCount\":780,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/xiarch.com\/blog\/#organization\"},\"articleSection\":[\"Vulnerabilities\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/xiarch.com\/blog\/what-to-do-when-firefox-users-cant-reach-microsoft-com\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/xiarch.com\/blog\/what-to-do-when-firefox-users-cant-reach-microsoft-com\/\",\"url\":\"https:\/\/xiarch.com\/blog\/what-to-do-when-firefox-users-cant-reach-microsoft-com\/\",\"name\":\"What to do When Firefox users can't reach Microsoft.com? - Xiarch Solutions Private Limited\",\"isPartOf\":{\"@id\":\"https:\/\/xiarch.com\/blog\/#website\"},\"datePublished\":\"2021-12-16T13:55:51+00:00\",\"dateModified\":\"2021-12-16T13:55:56+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/xiarch.com\/blog\/what-to-do-when-firefox-users-cant-reach-microsoft-com\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/xiarch.com\/blog\/what-to-do-when-firefox-users-cant-reach-microsoft-com\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/xiarch.com\/blog\/what-to-do-when-firefox-users-cant-reach-microsoft-com\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/xiarch.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"What to do When Firefox users can’t reach Microsoft.com?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/xiarch.com\/blog\/#website\",\"url\":\"https:\/\/xiarch.com\/blog\/\",\"name\":\"Xiarch Solutions Private Limited\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/xiarch.com\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/xiarch.com\/blog\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/xiarch.com\/blog\/#organization\",\"name\":\"Xiarch\",\"url\":\"https:\/\/xiarch.com\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/06\/xi-logo-002.png\",\"contentUrl\":\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/06\/xi-logo-002.png\",\"width\":300,\"height\":300,\"caption\":\"Xiarch\"},\"image\":{\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/xiarch\/\",\"https:\/\/twitter.com\/xiarch\",\"https:\/\/www.linkedin.com\/company\/xiarch\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/person\/655d814a04eacce56942270cfdc5c59c\",\"name\":\"Xiarch Security\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/d33699ed91b76568586dc1ae278ea568?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/d33699ed91b76568586dc1ae278ea568?s=96&d=mm&r=g\",\"caption\":\"Xiarch Security\"},\"sameAs\":[\"https:\/\/xiarch.com\/blog\/\"],\"url\":\"https:\/\/xiarch.com\/blog\/author\/vector\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"What to do When Firefox users can't reach Microsoft.com? - Xiarch Solutions Private Limited","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/xiarch.com\/blog\/what-to-do-when-firefox-users-cant-reach-microsoft-com\/","og_locale":"en_US","og_type":"article","og_title":"What to do When Firefox users can't reach Microsoft.com? - Xiarch Solutions Private Limited","og_description":"Those operating the Mozilla Firefox web browser are left incapable to access microsoft.com and its subdomains this week. Tests by our experts ensure the issue relates to SSL certificate validation errors. Below we explain what you can do to remedy the issue. Firefox: ‘Secure Connection Failed’ to Microsoft.com When using Firefox, accessing microsoft.com is not […]","og_url":"https:\/\/xiarch.com\/blog\/what-to-do-when-firefox-users-cant-reach-microsoft-com\/","og_site_name":"Xiarch Solutions Private Limited","article_publisher":"https:\/\/www.facebook.com\/xiarch\/","article_published_time":"2021-12-16T13:55:51+00:00","article_modified_time":"2021-12-16T13:55:56+00:00","og_image":[{"width":1000,"height":524,"url":"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/12\/What-to-do-when-Firefox-users-cant-reach-Microsoft.com-featured-image.jpg","type":"image\/jpeg"}],"author":"Xiarch Security","twitter_card":"summary_large_image","twitter_creator":"@xiarch","twitter_site":"@xiarch","twitter_misc":{"Written by":"Xiarch Security","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/xiarch.com\/blog\/what-to-do-when-firefox-users-cant-reach-microsoft-com\/#article","isPartOf":{"@id":"https:\/\/xiarch.com\/blog\/what-to-do-when-firefox-users-cant-reach-microsoft-com\/"},"author":{"name":"Xiarch Security","@id":"https:\/\/xiarch.com\/blog\/#\/schema\/person\/655d814a04eacce56942270cfdc5c59c"},"headline":"What to do When Firefox users can’t reach Microsoft.com?","datePublished":"2021-12-16T13:55:51+00:00","dateModified":"2021-12-16T13:55:56+00:00","mainEntityOfPage":{"@id":"https:\/\/xiarch.com\/blog\/what-to-do-when-firefox-users-cant-reach-microsoft-com\/"},"wordCount":780,"commentCount":0,"publisher":{"@id":"https:\/\/xiarch.com\/blog\/#organization"},"articleSection":["Vulnerabilities"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/xiarch.com\/blog\/what-to-do-when-firefox-users-cant-reach-microsoft-com\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/xiarch.com\/blog\/what-to-do-when-firefox-users-cant-reach-microsoft-com\/","url":"https:\/\/xiarch.com\/blog\/what-to-do-when-firefox-users-cant-reach-microsoft-com\/","name":"What to do When Firefox users can't reach Microsoft.com? - Xiarch Solutions Private Limited","isPartOf":{"@id":"https:\/\/xiarch.com\/blog\/#website"},"datePublished":"2021-12-16T13:55:51+00:00","dateModified":"2021-12-16T13:55:56+00:00","breadcrumb":{"@id":"https:\/\/xiarch.com\/blog\/what-to-do-when-firefox-users-cant-reach-microsoft-com\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/xiarch.com\/blog\/what-to-do-when-firefox-users-cant-reach-microsoft-com\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/xiarch.com\/blog\/what-to-do-when-firefox-users-cant-reach-microsoft-com\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/xiarch.com\/blog\/"},{"@type":"ListItem","position":2,"name":"What to do When Firefox users can’t reach Microsoft.com?"}]},{"@type":"WebSite","@id":"https:\/\/xiarch.com\/blog\/#website","url":"https:\/\/xiarch.com\/blog\/","name":"Xiarch Solutions Private Limited","description":"","publisher":{"@id":"https:\/\/xiarch.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/xiarch.com\/blog\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/xiarch.com\/blog\/#organization","name":"Xiarch","url":"https:\/\/xiarch.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/xiarch.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/06\/xi-logo-002.png","contentUrl":"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/06\/xi-logo-002.png","width":300,"height":300,"caption":"Xiarch"},"image":{"@id":"https:\/\/xiarch.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/xiarch\/","https:\/\/twitter.com\/xiarch","https:\/\/www.linkedin.com\/company\/xiarch"]},{"@type":"Person","@id":"https:\/\/xiarch.com\/blog\/#\/schema\/person\/655d814a04eacce56942270cfdc5c59c","name":"Xiarch Security","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/xiarch.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/d33699ed91b76568586dc1ae278ea568?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d33699ed91b76568586dc1ae278ea568?s=96&d=mm&r=g","caption":"Xiarch Security"},"sameAs":["https:\/\/xiarch.com\/blog\/"],"url":"https:\/\/xiarch.com\/blog\/author\/vector\/"}]}},"_links":{"self":[{"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/posts\/4036"}],"collection":[{"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/comments?post=4036"}],"version-history":[{"count":1,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/posts\/4036\/revisions"}],"predecessor-version":[{"id":4044,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/posts\/4036\/revisions\/4044"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/media\/4038"}],"wp:attachment":[{"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/media?parent=4036"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/categories?post=4036"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/tags?post=4036"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}