Certificate exceptions not working

[bsh]

Hi,
after upgrading(?) from TB78 to 91.3, I have trouble accessing Imap accounts and sending email over SMTP. Those servers use self signed certificates. When trying to access them, TB says there is an error with the configuration and asks if I want to trust the certificate and make a permanent exception for it. (Which I did and it was already like that before too.)
But regardless of the exception, TB forgets it or ignores it, and from time to time (usually after reboots) it comes up again with asking for the certificate etc.
I have deleted all exceptions from certificate manager and re-added those exceptions, to no avail.
Is this a bug or something has changed in TB so self signed certificates are not trusted anymore or something? (Then why does it asks if it should use a permanent exception?)

[WaltS48]

Is this article any help?

https://support.mozilla.org/en-US/kb/th ... -0-and-1-1

[bsh]

Is this article any help?

https://support.mozilla.org/en-US/kb/th ... -0-and-1-1

I doubt it. I can send and receive messages. It's just I regularly have to "make an exception" for the certificates, as if TB would forget about them being already added to exceptions.

[tanstaafl]

Moved from Thunderbird bugs to Thunderbird support as its not discussing workarounds for a confirmed bug report.

Any possibility that a load balancing router changes what host you connect to in a pool of servers, so that your exception doesn't always apply? Exceptions are host specific.

[Grumpus]

In the process of dealing with this myself.
Go to Preferences and in the search block type certificate.
When it opens read the various panels, under the servers panel the certificate should be listed
Also when accepting the exception there should be another button under it which confirms it, make sure you check it.
Comcast appears to be having an issue with a Comodo cert and proclaims it does not match the smtp.comcast.net:465 server.
The exception cert appears to be good but the panel seems to spread a little else but concern.

[bsh]

Any possibility that a load balancing router changes what host you connect to in a pool of servers, so that your exception doesn't always apply? Exceptions are host specific.

I don't think so. The servers are mine.
I did some further testing:
- same profile works on Windows 7 with TB91.3 32bit, but not on Win10 and TB 64bit
- other profile works on other Win10 machine, using same certificates.
So, maybe something is wrong with my profile, which is like 15 years old...? But it is working on win7? Dunno...
Any ideas how to debug this? Is there a way to move *everything* into a new clean profile, but excluding files that are probably not being used anymore?

[bsh]

Any possibility that a load balancing router changes what host you connect to in a pool of servers, so that your exception doesn't always apply? Exceptions are host specific.

figured it out. It was the antivirus not applying a setting to not try to scan SSL by injecting it's own crappy certificate. After fixing it all works as before. Strange it only happened on one machine, others are fine.