help - can't get to youtube and others - cisco umbrella root CA

[rfrazier]

@Steve or anyone. Help. I cannot get to youtube today and some other sites. I don't have hours to troubleshoot it now. Firefox did some kind of update yesterday. Until then, everything was working fine. I hate this rubbish! Here's part of the message. Anybody know what's up? All help is appreciated.

Software is Preventing Firefox From Safely Connecting to This Site

youtube.com is most likely a safe site, but a secure connection could not be established. This issue is caused by Cisco Umbrella Root CA,

May your bits be stable and your interfaces be fast. Ron

 

[miquelfire]

Sounds like some sort of proxy is in use, and Firefox doesn't trust the root certificate.

Are you using OpenDNS by chance? I know they were put under the Cisco Umbrella thing at some point. Your network might have a feature turned on for scanning on their end for bad stuff before it even hits your computer.

 

[AlanD]

Are you using OpenDNS, either knowingly, or through your ISP? Have a look at https://support.opendns.com/hc/en-u...-Errors-Installing-the-Cisco-Umbrella-Root-CA

 

[rfrazier]

Thank you guys. I am using OpenDNS, although I could change that. I'll take a look at the link. Is that CA something I can trust?

May your bits be stable and your interfaces be fast. Ron

 

[AlanD]

Define "trust". Presumably the reason that you need their root certificate is so that they can intercept your SSL traffic and inspect it for harmful things ( viruses etc). The problem is that it means they can intercept and inspect everything. YMMV

 

[rfrazier]

My router and Windows DNS settings point toward OpenDNS servers, but that is the extent of things. I don't use any of their apps, etc. I didn't ask for their CA. My browser just suddenly started giving that error message every time I go to YouTube and a few others.

May your bits be stable and your interfaces be fast. Ron

 

[PHolder]

This is months old, but may be insightful:

https://www.reddit.com/r/firefox/comments/fprphc

 

[Barry Wallis]

@rfrazier: Since you mentioned this happened after a FF update, have you tried a different browser?

 

[rfrazier]

Frankly, I just discovered it this morning, said a few selected harsh words to the computer, and moved on. I haven't had a couple of hours to troubleshoot it, and haven't successfully visited YouTube since the problem. I've been tied up with other things including researching how Windows 7 interacts with TRIM interacts with defrag for posting on another thread here on the forum. I'm hoping to get back to the problem of THIS thread a bit later.

But, since you mentioned it, I fired up Brave and went to YouTube. I get this error.

Your connection is not private​

Attackers might be trying to steal your information from youtube.com (for example, passwords, messages, or credit cards). Learn more


NET::ERR_CERT_AUTHORITY_INVALID

But wait, there's more ...

On a whim, I disconnected my TorGuard VPN. I was then able to connect with Firefox. I tried Brave and I was able to connect.

Then, I reconnected TorGuard but to a different city. I was able to connect with both browsers. I then put it back to the original city. I was able to connect with both browsers.

Whatever happened is above my pay grade. But, it appears I may have solved the problem. I appreciate everybody's suggestions and, if the problem reappears, I plan to pursue them.

May your bits be stable and your interfaces be fast. Ron

 

[Barry Wallis]

I hate when problems seem to fix themselves. I'm glad it's fixed for you though.

 

[rfrazier]

Thanks. I'm glad it's gone, if it's gone. I'd rather it never appeared at all though.

May your bits be stable and your interfaces be fast. Ron

 

[PHolder]

Well if you're using Tor you have bigger problems than certificates... Tor exit nodes are not guaranteed to be trustworthy, and in fact a great many of them are not. It's been well reported how people downloading executables over Tor have received virus laden files. Tor is not the same as a reputable VPN.

 

[rfrazier]

TorGuard VPN is completely separate and different from Tor, but thanks for the tips.

Anonymous VPN, Proxy & Email Services | TorGuard

Protect your identity and personal privacy with our anonymous VPN, proxy & email encryption services for individuals and businesses. All of our packages include unlimited speeds and bandwidth in 50+ countries. Get TorGuard today!

torguard.net

May your bits be stable and your interfaces be fast. Ron

 

[PHolder]

TorGuard VPN is completely separate and different from Tor

Well that was their mistake in choosing a name then.

From their FAQ:

Is TorGuard related in any way to the “tor” project?
Answer: No, The reference to "tor" in TorGuard relates to "torrents" and guarding one’s privacy when using bitorrent. We are not related in any way to the “tor” project however the company does support through donations.

So they're based on piracy privacy... still not sure that'd be a brand I'd trust.

 

[rfrazier]

AFAIK they are a well respected VPN Provider. I don't know that I'd say all torrents are piracy. Not quite sure how it got late. Where does the time go? Supper time. More research has to wait.

May your bits be stable and your interfaces be fast. Ron

 

[PHolder]

I don't know that I'd say all torrents are piracy

Perhaps not, but then why would you be paying money for privacy for them?

 

[rfrazier]

Same reason you pay a VPN provider for privacy for other things. I run a VPN all the time on every PC as a standard practice.

May your bits be stable and your interfaces be fast. Ron

 

[PHolder]

That may be YOUR motivation Ron, but that is clearly not THEIR motivation for selling the service. (Which was my point... it's about them and their poor name choice, and nothing to do with your choices, poor or not.)

 

[rfrazier]

I see. Well, I don't know anything about the name other than what's in the FAQ. They were recommended to me by someone knowledgeable in another group years ago and they seem to do what I need.

May your bits be stable and your interfaces be fast. Ron

 

[miquelfire]

The way OpenDNS identify customers is with IP addresses. I bet what happened was someone who turned on a service with their OpenDNS account that needed them to install the root cert happened to use the same exit node as you. Either they got another IP and their tool to updated their account info, or when you reconnected, you got an IP OpenDNS doesn't identify as a special account.