This site will have limited functionality while we undergo maintenance to improve your experience. If an article doesn't solve your issue and you want to ask a question, we have our support community waiting to help you at @FirefoxSupport on Twitter and/r/firefox on Reddit.

Search Support

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Learn More

Validity of security certificate on a website

  • 7 cavab
  • 3 have this problem
  • 16 views
  • Last reply by crawj

more options

I am looking for help on the validity and security of a website. The page in question is the one that opens when clicking the "Start Now" button on this page: https://www.gov.uk/send-vat-return

When the "Start now" button is pressed a new tab opens up and briefly a green padlock is seen before turning into a grey triangle with an exclamation mark.

My questions are: Is the site secure? And if it is why am I getting the grey triangle with the exclamation mark?

Many thanks

I am looking for help on the validity and security of a website. The page in question is the one that opens when clicking the "Start Now" button on this page: https://www.gov.uk/send-vat-return When the "Start now" button is pressed a new tab opens up and briefly a green padlock is seen before turning into a grey triangle with an exclamation mark. My questions are: Is the site secure? And if it is why am I getting the grey triangle with the exclamation mark? Many thanks

Chosen solution

You can use the Web Console to further investigate the problem. Here's how:

Open the Web Console in the lower part of that tab using either Ctrl+Shift+k or the Developer menu.

Reload the page bypassing cache (Ctrl+Shift+r, or Shift+click the reload button in the address bar).

Check for red warning triangles.

As shown in the attached, the site hosting the analytics script uses the RC4 cipher, which Firefox 36 and later treat as insecure. In a future version, Firefox won't even load the script, so it's something the site should try to work out with its vendor.

Read this answer in context 👍 1

All Replies (7)

more options

Oddly, I see the green padlock the entire time.

The grey triangle means that parts of the page are secure, but parts of it (specifically some of the images) are not.

more options

Hello, user293 is correct. the not secure part of the webpage in the analytics-egain.com

thank you

EDIT ; probably the site is Ok, maybe some part of the code is incorrect :

https://safeweb.norton.com/report/show?url=analytics-egain.com

https://app.webinspector.com/public/reports/36559585

Modified by ideato

more options

I have tried a few computers and the follow up page after clicking the "start now" button always gives me the grey triangle with the exclamation mark unfortunately.

Looking at the browser console under security what stood out was the line saying:

"online.hmrc.gov.uk : server does not support RFC 5746, see CVE-2009-3555"

Would this be a cause for concern as well?

Thanks

Modified by crawj

more options

Seçilmiş Həll

You can use the Web Console to further investigate the problem. Here's how:

Open the Web Console in the lower part of that tab using either Ctrl+Shift+k or the Developer menu.

Reload the page bypassing cache (Ctrl+Shift+r, or Shift+click the reload button in the address bar).

Check for red warning triangles.

As shown in the attached, the site hosting the analytics script uses the RC4 cipher, which Firefox 36 and later treat as insecure. In a future version, Firefox won't even load the script, so it's something the site should try to work out with its vendor.

more options

By the way, the analytics site is sending a script file, so you can use an extension to block that if you like and see a green lock for the page.

If you would rarely want to do this, you could try YesScript: https://addons.mozilla.org/firefox/addon/yesscript/

more options

I see this message in the Web Console (Firefox/Tools > Web Developer) that is likely responsible for this issue.

This site uses the cipher RC4 for encryption, which is deprecated and insecure.

This is about requesting this file as you can see in the Network monitor (see the icon in the domain column):

more options

Thank you all for your help.