Using Ubuntu 24.04.2 LTS.
Suddenly, after a recent update of Ubuntu, an attempt to access an Outlook Web site resulted in a Privacy Error that prevents sign in unless the warning is overriden. (See attachment below.) This error occurs on two different browsers, Chrome and Firefox, on my Ubuntu computer and the error does not occur when using any other computer (Windows or Linux Lite). Thanks in advance for any suggestions on how to fix this problem.
Welcome to Ubuntu Discourse 
In a terminal run this command and post the output here please:
curl -v https://mercury.law.nyu.edu
This looks suspiciously like a self signed certificate which would normally be considered invalid, not sure how/why Windows or linux lite would not mark it like that … (but lets see what the curl command returns)
Secure TLS certificates always need to be counter signed by a certificate Authority (CA), Ubuntu ships by default the full list and public keys of CAs so certs can be verified against them, self signed certs simply have not been counter signed by a CA
Thanks for the quick response. Here are the results (after I installed curl):
lobalobo@lobalobo-Ecolite-Series:~$ curl -v https://mercury.law.nyu.edu
curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the webpage mentioned above.
And I too was confused by why Ubuntu but not Linux Lite or Windows rejected the certificate, but I’m quite certain that I received no warnings navigating to the site on computers with either Linux Lite or Windows, and I had no trouble on Ubuntu either until an update about a week ago.
sudo apt update
sudo apt install --reinstall ca-certificates
sudo update-ca-certificates
As a first step, let’s try updating the Certificate Authority (CA) certificates on your system.
Run each command above and then try the same curl command again to check if the issue is resolved.
Will try this later today and report back. Thanks so much for the help.
Unfortunately, these steps did not fix the problem. Here is the new report from the curl command:
curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the webpage mentioned above.
Unfortunately, I am out of ideas for this and I definitely do not want to suggest manual fixes that might compromise security.
Is there an IT department at your school who you can contact?
Tell them there seems to be an issue with the site certificate and ask them to review or fix.
Hopefully, someone here can offer other ways to sort this out.
Afterthought: did you restart the computer after updating the CA certificates?
Checked: I can access the site without security warnings on Ubuntu 24.04.2 using either Firefox or Chromium.
Perhaps @ogra has some suggestions?
Not a lot beyond contacting the server admins, the server does not seem to even send proper CA info:
$ openssl s_client -connect mercury.law.nyu.edu:443
[...]
subject=DC=org, DC=incommon, C=US, ST=New York, O=New York University, CN=mercury.law.nyu.edu
issuer=C=US, O=Internet2, CN=InCommon RSA IGTF Server CA 3
---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: RSA-PSS
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 2581 bytes and written 416 bytes
Verification error: unable to verify the first certificate
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 2048 bit
This TLS version forbids renegotiation.
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 21 (unable to verify the first certificate)
---
[...]
This “No client certificate CA names sent” looks mis-configured to me
Checked: I can access the site without security warnings on Ubuntu 24.04.2 using either Firefox or Chromium.
How odd is that? Seems every computer with any operating system other than mine can connect to the site, but mine cannot (and that’s having tried two browsers).
[Yes, I believe I restarted the computer after the update, but I’ll try that again next time I’m home with the computer.]
Thanks.
Ogra: Thanks, I will contact my IT department, but not sure what to say inasmuch only this one computer has any difficulty.
On that error page, click on advanced and see what it says
Here is what Advanced says on the error page:
This server could not prove that it is mercury.law.nyu.edu; its security certificate is not trusted by your computer’s operating system. This may be caused by a misconfiguration or an attacker intercepting your connection.
So, although rebooting after updating the certificates didn’t help, here is something odd that I discovered: No Error messages when the server is accessed in Incognito mode. Does that give anyone any idea of what’s wrong? More curious than anything else at this point.
Try clearing browser cache, history, and cookies.
Would use the option to delete from all time or forever or whatever it says these days
This would be a great place to start, Why, Error Causes Invalid SSL certificate
I have never had to go past the above to solve it.
I too checked:
Post-Handshake New Session Ticket arrived:
SSL-Session:
Protocol : TLSv1.3
Cipher : TLS_AES_256_GCM_SHA384
Session-ID: EB0E45F89FE6F2859E1367EB66101D90709C9083545BD416D595E31425C9EEE7
Session-ID-ctx:
Resumption PSK: D3A38F74CAE793C0847175A23B9D74722771A9F319A959E9C0F45D7D6C4B57DA2688314D61CD13F242435D91E11B612A
PSK identity: None
PSK identity hint: None
SRP username: None
TLS session ticket lifetime hint: 7200 (seconds)
TLS session ticket:
0000 - 91 67 7d 1d 55 f8 f2 29-5d 57 22 46 cb 38 ef c9 .g}.U…)]W"F.8…
0010 - 2a 0f 03 58 db 37 c7 ff-a0 e6 0f a8 95 a1 61 6f *…X.7…ao
Start Time: 1743713240
Timeout : 7200 (sec)
Verify return code: 21 (unable to verify the first certificate)
Extended master secret: no
Max Early Data: 0
Post-Handshake New Session Ticket arrived:
SSL-Session:
Protocol : TLSv1.3
Cipher : TLS_AES_256_GCM_SHA384
Session-ID: 342B28D25A3B1625C1E5DD9DF6372A0B6057C5A9314E2F33C9848D102DECDD9D
Session-ID-ctx:
Resumption PSK: 9583D1B2A38D4071CE8567ED97981183FBAAAB4E36BB8FFB827F1A4B7774251D283AE4D5AAE16C436B1C0A4E92C0DBBA
PSK identity: None
PSK identity hint: None
SRP username: None
TLS session ticket lifetime hint: 7200 (seconds)
TLS session ticket:
0000 - 03 ef 2b 10 dd bd 2f 99-44 1d ad 27 ea 14 f7 cf …+…/.D…'…
0010 - 19 81 7e 02 4f 43 ee de-02 04 65 7d 4f 80 e8 7a …~.OC…e}O…z
Start Time: 1743713240
Timeout : 7200 (sec)
Verify return code: 21 (unable to verify the first certificate)
Extended master secret: no
Max Early Data: 0
read R BLOCK
80DB19C6C0720000:error:0A000126:SSL routines::unexpected eof while reading:ssl/record/rec_layer_s3.c:688:
Try clearing browser cache, history, and cookies.
This did the trick, thank you. Funny thing is that, not too long ago, I was a Google Photos product expert (all volunteer, like this site), and I had a canned answer to half a dozen problems suggesting clearing the cache and cookies. Somehow, though, it did not occur to me to try this here. Glad you were smarter. Thanks again.
This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.
