"Unable to complete secure transaction" Error

"Unable to complete secure transaction" Error

I am using Opera 12 build 1406 and at times, without any apparent reasons, Opera gives error 49 while loading some websites.
The complete error message is :

Unable to complete secure transaction
Secure connection: fatal error (49)
https://lastpass.com/index.php
The certificate is valid, but permission denied.

This is the error message for LastPass website, which it loaded perfectly in the previous session(and probably will once I restart the browser).
Initially I got this error for Gmail quite often when I upgraded to this build, so, just to be sure, I did a clean, standalone install and Gmail worked fine but now LastPass does not open.
I am using the 64 bit build on Windows 7 x64 home premium, with lastpass, tabvault and wot extensions and no other changes, except setting this installation as default browser and setting Monster as theme.
Has anyone else had similar problem?

Error #49 means that the certificate presented by the server is on the untrusted list, or the "forbidden for SSL" flag for the CA Root is enabled. You might take a look an see if any certificate has been configured in that list.

AFAICT, from my location, the site loads OK here, and shows as an Extended Validation certificate.

Please note that we are aware of one or more variants of malware that presents fake certificates in order to intercept secure transactions. This might be another occurrence of that malware.

I also have installations of Opera 11.64, 11.52, Firefox, Chrome and Internet Explorer and none of them has any problem loading the site. As far as certificate is concerned, I have not tampered with any of them(I believe you refer to Preferences>Advanced>Security>Manage Certificates). I have also done a complete scan with Kaspersky Internet Security 2012.
Could you suggest how to ensure that certificates configuration is at its default value and if there is any way to determine if it is a malware at work.?
Thanks.

You might want to test in a separate, clean installation.

The Root Certificate to check the settings of, is the "Thawte Primary Root CA", it should have the flag "Allow connections" enabled.

Certificate is enabled. Did another clean install and no problem so far, but since my last 2 clean installations had this problem, I am still wary about it. Will report if the bug arises again.
Thanks

Originally posted by machs:

Certificate is enabled. Did another clean install and no problem so far, but since my last 2 clean installations had this problem, I am still wary about it. Will report if the bug arises again.
Thanks

I get this problem sometimes while accessing google services (Gmail or google Plus).

Hey guys,

I don't know why but this problem suddenly arose today, when I was about to go to the Twitter page which uses SSL/HTTPS. The error says that the certificate is valid but that the permission is denied. However, I tried this with Opera 11.64 and Safari 5.x (the x is because I don't know the version number since it got installed with the OS X update...) and it worked great. My current Opera Next build is 1433 (last snapshot so far) and I just wanted to tell you guys that this is not working. Maybe you've got a suggestion how to fix it?

Also the error message says error number 49 and that it's a fatal error. It occurs on the Twitter page (with HTTPS enabled) and when I try to log in to my Google Drive account, too. Tried a fresh installation of this build and of the current stable beta-build, no luck with version 12. Don't know why...

As already said, version 11.64 works well. I haven't changed anything to the certificates manager and as far as I know nobody other did it.
Need some help.

Thanks in advance and keep doing that great browser :-)
Greets.

Originally posted by TheMüllmann:

Hey guys,

I don't know why but this problem suddenly arose today, when I was about to go to the Twitter page which uses SSL/HTTPS. The error says that the certificate is valid but that the permission is denied. However, I tried this with Opera 11.64 and Safari 5.x (the x is because I don't know the version number since it got installed with the OS X update...) and it worked great. My current Opera Next build is 1433 (last snapshot so far) and I just wanted to tell you guys that this is not working. Maybe you've got a suggestion how to fix it?

Also the error message says error number 49 and that it's a fatal error. It occurs on the Twitter page (with HTTPS enabled) and when I try to log in to my Google Drive account, too. Tried a fresh installation of this build and of the current stable beta-build, no luck with version 12. Don't know why...

Had the same problem today, after my upgrade to 12. No twitter, very same message, but nothing changed on certs or preferences.
Fiddled a bit around, tried with new profile and it worked. So I tried different files between old and new profile to find what causes the problem, but without success. At some point I had copied all the files from my old profile to the new one and it still worked. Weird.
After that I just closed Opera (with the old profile) and started again, and what should I say. I can tweet and read, no https error message.
So I don't know the answer why this problem occurred, but it's gone now.

Aha, didn't make the connection at first.

Both Twitter and lastpass are sending the HTTP Strict Transport Security (HSTS) header, an indication that their site must only be loaded over a secure connection. This is a new feature added in Opera 12, and means that once a site has sent this signal, even trying to load a http URL for that site, Opera will automatically change the URL to a HTTPS URL before starting to load the URL.

In Opera, "secure connection" does not just mean that HTTPS is used, that all encryption keys are of secure length (minimum 128 bit symmetric, 1024 bit asymmetric), and no certificate security warnings, it also means that all the revocation checks (to make sure the certificate is still valid) must complete successfully. It is probable, in the above cases, that there was a revocation hick-up, they happen occasionally (and would previously "only" cause the padlock to be removed).

At present, such hick-ups require a restart of Opera to be cleared. Unless the hick-up is a long term incident, then the site should work fine afterwards.

The web site can significantly reduce the risk of such problems by enabling what is called TLS OCSP "stapling" in their server. Modern releases of both Apache and IIS support this feature, IIS by default, in Apache it have to be turned on manually.

Originally posted by yngve:

Aha, didn't make the connection at first.

Both Twitter and lastpass are sending the HTTP Strict Transport Security (HSTS) header, an indication that their site must only be loaded over a secure connection. This is a new feature added in Opera 12, and means that once a site has sent this signal, even trying to load a http URL for that site, Opera will automatically change the URL to a HTTPS URL before starting to load the URL.

In Opera, "secure connection" does not just mean that HTTPS is used, that all encryption keys are of secure length (minimum 128 bit symmetric, 1024 bit asymmetric), and no certificate security warnings, it also means that all the revocation checks (to make sure the certificate is still valid) must complete successfully. It is probable, in the above cases, that there was a revocation hick-up, they happen occasionally (and would previously "only" cause the padlock to be removed).

At present, such hick-ups require a restart of Opera to be cleared. Unless the hick-up is a long term incident, then the site should work fine afterwards.

The web site can significantly reduce the risk of such problems by enabling what is called TLS OCSP "stapling" in their server. Modern releases of both Apache and IIS support this feature, IIS by default, in Apache it have to be turned on manually.

Aha, cool! Though this error has been cleared after a fresh set up with a new profile, it's good to know such things and that Opera is improving on security features! :-)

Greets!

Originally posted by yngve:

At present, such hick-ups require a restart of Opera to be cleared. Unless the hick-up is a long term incident, then the site should work fine afterwards.

I've got this issue with twitter since v12 upgrade.

Secure connection: fatal error (49)
https://twitter.com/
The certificate is valid, but permission denied.

I've restarted Opera 20+ times since then (and rebooted computer maybe 5-10 times). Not helping. I haven't seen twitter site since v12.

Crocodiledan: Sounds to me like you have something blocking revocation, or otherwise interfering with the secure connection. Might even be the SSL malware that have been making the rounds recently. Accepted any certificate dialogs recently, and marked them as "remember"?

Can't remember precisely, but I am usually not accepting any certificates unless I am sure I'm at the correct site and there is the need for secure transactions.
And at the moment I've got both Approved and Rejected certificate lists empty if that matters.

I have the same problem as crocodiledan.

I have Opera 12, installed, and it work fine there, but it dont work on Opera 12 Next: 12.01 ( 1473 )

Im using Windows7 ultimate x64

Same problem here. Opera 12 build 1467, Windows XP. Error appears after few hour (or days). Restarting Opera usually solves issue.
I found that it appears on e.g. https://twitter.com, https://mail.google.com... But no problem on https://facebook.com

Downloaded installer and "upgraded" v12.0 to v12.0
It solved the problem so far.

Upgraded today to 12.01 and got fatal error 49 for Gmail. Fresh restart does not fix the issue. Worked fine on 12.0. Help! Need my gmail on my pc.

Secure connection: fatal error (49)

https://accounts.google.com/ServiceLogin?service=mail&passive=true&rm=false&continue=http://mail.google.com/mail/&scc=1&ltmpl=default&ltmplcache=2

The certificate is valid, but permission denied.

Am running:
12.01 internal
Build
1473
Platform
x64
System
Windows Vista

Originally posted by vo1234:

Upgraded today to 12.01 and got fatal error 49 for Gmail. Fresh restart does not fix the issue. Worked fine on 12.0. Help! Need my gmail on my pc.

Secure connection: fatal error (49)

https://accounts.google.com/ServiceLogin?service=mail&passive=true&rm=false&continue=http://mail.google.com/mail/&scc=1&ltmpl=default&ltmplcache=2

The certificate is valid, but permission denied.

Am running:
12.01 internal
Build
1473
Platform
x64
System
Windows Vista

It's a temporary workaround to fix that problem, but Ou can back up your data with Opera Link and go ahead and delete your existing Opera profile. Start over anew and sync your bookmarks, passwords, ... back from Opera Link.

That solved it for me...

By the way... This forum is crap to type in via iPhone... Even in "mobile view"

Thanks for the workaround...

Delete my private data or actually delete my profile which contains my username and password for Opera altogether? I'm afraid I'm going to need details.

similar situation for me.
"
Secure connection: fatal error (49)
https:// ++++++ site here +++++++++++
The certificate is valid, but permission denied.
"

if theres an easy answer to a simple question, the question would be: how do i allow permission? where are the settings for this sort of thing?
i seemed to have exercised all possibilities to my knowledge... allow popups, allow cookies, blocked content et al. also uninstalled then reinstalled opera though it seemed to have remembered this preference:
for me, the site is my web portal, so to use opera im now having to visit the site via safari to connect to net then can use opera to surf.
in opera, for the site i mention, security popups would appear with reject or approve options. for weeks left it as was but other user of this computer had enough and so clicked the box to 'dont ask me this again' or maybe it was 'reject' with 'remember this preference'.
... ? im pretty simple (and learning lots about computers only recently). any help much appreciated. thanks.

stoppingtheworld: The current main reason for this alert is that the site is sending the HTTP SStrict-Transport-Security (HSTS) header (http://datatracker.ietf.org/doc/draft-ietf-websec-strict-transport-sec/ ).

When sending that header the server specifically instructs the client to not establish an unsecure connection with the site, and in Opera "unsecure" also includes weak encryption (such as a weak DHE or RSA keys) and failed revocation checks. The first require reconfiguration of the server, the second can in part be avoided by the server sending the Certificate Status TLS extension, and ensuring that the OCSP and CRL revocation URLs load successfully. Additionally, connections using manually accepted certificates are considered unsecure.

All of these reasons will trigger a missing padlock in Opera.

The other reason for this alert is that the certificate presented by the site has been marked permanently as untrusted. For manually accepted certificate this can be undone by removing it in the "rejected" section of the Certificate Manager.

If you get certificate warnings about a problem you should fix the problem (or get it fixed), not create exceptions.

In the link provided, the word "ABSTRACT' seems to stand out to me.
Much else there seems to go over my head.

As did much of your reply.
" ... HSTS, DHE or RSA keys, Certificate Status TLS extension, OCSP and CRL revocation URLs ... "

again, I'm simply just begining to learn here. (or trying to)

"If you get certificate warnings about a problem you should fix the problem (or get it fixed), not create exceptions."

i don't mean to take a defensive position, but the reason i created yet another account, one more password, join another 'community' here at opera was only so i could simply post this shout for help ie. how to "fix the problem (or get it fixed)'
i mean; what i typed, does it not read: i have this problem. how do i fix it?

i appreciate the information provided as it can be helpful for this learning experience.
was looking for a reply even something like 'if you manage to somehow track down the certificate manager you can remove it from list'


im a bit red faced now. sat at the wrong lunch table trying to fit in.
why do i find these forums for open source software full of jargon for a gated community?

-just another mac user used to things simply working. perhaps i should just go find my seat at the table with all the other callow folk using chrome; safari etc'?

same problem on https sites:
Es ist nicht möglich die sichere Transaktion abzuschließen
https://de.foursquare.com
https://twitter.com/

css files are'nt loaded
example:
https://ss1.4sqi.net/styles/redesign/standalone-pages/redesign-product-page-7e1d984adc843a00391d2d784c242299.css
Es ist nicht möglich die sichere Transaktion abzuschließen
Details zeigen: Sichere Verbindung: Schwerer Fehler (50)

I can report the same problem with Opera 12.00 (1467) under Linux. So far I cannot access to gmail. I wouldn't know if f*cebook or the other work at all, but I've tried a couple of https urls listed in this thread, lastpass and foursquare (that I've never visited before), and they load fine.

My "approved" and "rejected" lists of certificates are empty.

I understand that the issue might arise from a security feature (more strict measures when getting HSTS headers, which is a great thing) that faces a "revocation hick-up" or something.

For me, re-starting the browser has done nothing. Would deleting the profile really solve the problem? How? Would I have to do this repeatedly if the issue reappears or occurs for a different website? Should gmail change something?

Thank you.

Patchstar: Code 50 is a completely different issue, and we've recently discovered that it is most likely related to being connected via a captive portals or other software (such as filters) replacing CRL files with non-CRL content.

stoppingtheworld: Sorry, but this area of technology has quite a few terms that require a bit of acclimatization.

If you get certificate warnings on a site, assuming you use the right URL, that usually means that the administrator (whether it was you, or somebody else) configured the server either made a mistake when configuring it, or did not provide you with enough information (including certificates to install) so that you could access the server without getting those warnings. In either case, the administrator is the right person to ask, and to fix the issue.

The Certificate Manager is found in Menu>Settings>Preference>Advanced>Security>Manage Certificates.

Originally posted by stoppingtheworld:

i have this problem. how do i fix it?

In order to discover what a problem is, we need sufficient details to determine what the problem is. Given the information above, we do not have a URL, only that the site is a home page, presumably not a public site, but privately maintained (since the URL is not provided); we have an error indication that have multiple reasons, one which is new and which would not trigger the error in v11.6x; an indication that the site trigger certificate warnings. That is, unfortunately, only enough to provide general advice for where to look.

Much appreciation
-Curtis

Originally posted by vo1234:

Thanks for the workaround...

Delete my private data or actually delete my profile which contains my username and password for Opera altogether? I'm afraid I'm going to need details.

I meant deleting your profile which contains your Opera settings, passwords, ... (including your private data). But you SHOULD backed them up via Opera Link to sync them back afterwards.
If you do so, you won't experience any data loss. I discovered just to copy the profile and pasting it changes nothing. I don't really know what exactly triggers this problem but starting a new Opera profile and syncing the data from the old one via Opera Link just solved that issue...

@yngve
So the webpage administrator haven't done a mistake configuring the server (Twitter, for example) if the page works perfectly after doing this "profile cleanup". There must be something mistaken inside the profile files... Twitter just didn't load with error 49 before that workaround and afterwards it worked perfectly. Also the Google account login pages did. What's wrong here...?

@stoppingtheworld
Try that workaround and please don't mess with your certificates if you haven't changed anything yet and the error just occurs out of the blue. You can use your account created for this community to use Opera Link since it's your "Opera account".

THERE IS ABSOLUTELY NO NEED TO DESTROY THE PROFILE DUE TO THIS ISSUE


TheMüllmann: The issue with Twitter is NOT due to any server misconfiguration issue, it is caused by network related hickups that will be resolved by just restarting Opera; there is absolutely no need to do anything to your configuration, except restarting and maybe clearing the cache.

stoppingtheworld's issue sounds completely different, and may be due to actions taken when responding to certificate warnings (not enough details to determine if that is the case).

This error message can be displayed for several reasons:

* Site have configured HTTP Strict Transport Security, HSTS (like Twitter), and the revocation check fails temporarily.
* The site certificate have been manually untrusted, either until Opera is shut down, or permanently through the Rejected certificate manager section
* The site is using a certificate that chains to a certificate or Root that is not permitted for SSL sites.
* The site is using blacklisted, fraudulent certificates, blacklisted through Opera's online repository.

The most likely reason to see this, currently, is HSTS + revocation failure, reason #1, which a restart should fix, unless your system configuration blocks the revocation URLs (possible reason: captive Wi-Fi portals or filters messing with the requests). Clearing cache might be necessary in the latter case.

Thank you Ingve for the clarification.

I can report that, as "mysteriously" as it appeared, the problem has disappeared. Closing and opening Opera didn't work for a couple of days, and I suspect that, in my case, I had to shut the computer down completely, which is what I did last night.

Regards.

Restarting Opera fixed the problem for me, but may I propose that the error window has more useful information? For starters suggestion to restart browser, but even further actual information on which certificate did not pass the check.

Closing and opening Opera or restart the pc has no effect for me.
the problem is since update opera to V 12.00

i tried opera next 12.01 http://my.opera.com/desktopteam/blog/2012/06/26/html5-dnd-fixes-for-12-01 and this works.
so i think it's a bug in opera 12.00 and hope for an early update

Restarting opera helped with twitter, but not with facebook. The page loads, but the stylesheets don't - they are transferred securely too

AFAIK Facebook does not use HSTS, and use of HSTS is a requirement for observing the problem discussed here.

One of the said stylesheets:
https://s-static.ak.fbcdn.net/rsrc.php/v2/yd/r/foqmThlCxuU.css
Result:
Unable to complete secure transaction

You tried to access the address https://s-static.ak.fbcdn.net/rsrc.php/v2/yd/r/foqmThlCxuU.css, which is currently unavailable. Please make sure that the web address (URL) is correctly spelled and punctuated, then try reloading the page.

Secure connection: fatal error (50)

https://s-static.ak.fbcdn.net/rsrc.php/v2/yd/r/foqmThlCxuU.css

Transmission failure.

External tool reported these headers:

Status: HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Content-Type: text/css; charset=utf-8
Last-Modified: Wed, 27 Jun 2012 21:35:35 GMT
X-Content-Type-Options: nosniff
X-FB-Debug: t89aKSMY5NOBM3BGxMAOEc2Fe93mfdUmkw5JRQeVnqc=
X-Cnection: close
Cache-Control: public, max-age=31139909
Expires: Thu, 27 Jun 2013 21:56:56 GMT
Date: Mon, 02 Jul 2012 11:58:27 GMT
Transfer-Encoding: chunked
Connection: close
Connection: Transfer-Encoding

Fatal error 50 is a completely different error from the one discussed here, one that you should never see normally, but one that we have recently discovered will appear, at least, on specially configured captive Wi-Fi hotspots (where you have to log in), and that particular problem have recently been fixed.

Just to be clear on this, I do not use wi-fi, I use desktop connected by standard ethernet wire. There is no log-in. Thanks for the info, the fic would be appreciated. Github does the same thing - web loads, css, dont.

@Svoboda

same problem with opera when calling https://s-static.ak.fbcdn.net/rsrc.php/v2/yd/r/foqmThlCxuU.css

Es ist nicht möglich die sichere Transaktion abzuschließen
Details zeigen 

Sichere Verbindung: Schwerer Fehler (50) https://s-static.ak.fbcdn.net/rsrc.php/v2/yd/r/foqmThlCxuU.css Übertragungsfehler

Überprüfen Sie, ob die Adresse richtig geschrieben ist, oder suchen Sie nach der Website.

no wi-fi connection!!!!

no problem with firefox, chrome, ie and safari

Another:

https://accounts.google.com/ServiceLogin?uilel=3&service=youtube&passive=true&continue=http%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26feature%3Dheader%26nomobiletemp%3D1%26hl%3Den_US%26next%3D%252F&hl=en_US&ltmpl=sso

Wi-fi is the place where we have (ourselves) seen it so far, on a net using HTML pages to redirect to login, rather than HTTP redirects. There are other possible reasons too, primarily involving both bad firewalls or HTTPS intercepting malware, although a corrupted certificate repository is a slight, but remote, possibility.

Funny thing is, when I install clean Opera, everything works fine.

I got the fatal error 49 for Gmail some 24 hours ago with Opera 12.00 build 1467 for Windows. Hibernated my PC and didn't turn it on until now. The problem hadn't fixed itself but then I just restarted Opera and now it works again. When the error appeared my network was badly congested, I guess that might have caused the "temporary hickup". "Just my 0.02 €..."

This is still happening here... I'm on a good cable network and I'm unable to access twitter or orange.pl via https. Tried restarting browser and cleaning cache, no luck - error 49.

Version
12.00
Build
1467
Platform
Linux
System
x86_64, 3.2.0-25-generic

Error 49 @ https://flacforthemasses.com/

Version 12.50 internal
Build 1497
Platform x64
System Windows 7
Opera/9.80 (Windows NT 6.1; Win64; x64; U; Edition Next; en) Presto/2.11.310 Version/12.50

In my case the culprit was opssl6.dat. Moving this file solved my issues with https://bbs.archlinux.org/.

Although I couldn't find any official info about this file it looks to me as it's some kind of ssl state/cache.

I've also corrected the problem by moving/deleting the opss16.dat file. It appears that this file has become corrupted. File can be found in: C:/Users/user/AppData/Roaming/Opera/Opera.

Move and restart Opera. During restart, a new copy of the file will be made.

Harder

Originally posted by arthur.titeica:

In my case the culprit was opssl6.dat. Moving this file solved my issues with https://bbs.archlinux.org/.

Although I couldn't find any official info about this file it looks to me as it's some kind of ssl state/cache.

no help for me. same error

take a look at twitter:

so angry

https://twimg0-a.akamaihd.net/a/1341848431/t1/css/t1_core_logged_out.bundle.css

Es ist nicht möglich die sichere Transaktion abzuschließen
Details zeigen 

Sichere Verbindung: Schwerer Fehler (50) https://twimg0-a.akamaihd.net/a/1341848431/t1/css/t1_core_logged_out.bundle.css Übertragungsfehler

Überprüfen Sie, ob die Adresse richtig geschrieben ist, oder suchen Sie nach der Website.

Originally posted by Patchstar:

no help for me. same error

Sichere Verbindung: Schwerer Fehler (50) https://twimg0-a.akamaihd.net/a/1341848431/t1/css/t1_core_logged_out.bundle.css Übertragungsfehler

Originally posted by yngve:

Fatal error 50 is a completely different error from the one discussed here, one that you should never see normally, but one that we have recently discovered will appear, at least, on specially configured captive Wi-Fi hotspots (where you have to log in), and that particular problem have recently been fixed.

Please read this again and do not post any Error 50 related stuff in this thread anymore. Thanks

Deleting opssl6.dat worked for me too.

As a side note, Delete Private Data tool should allow deleting this file too, so we can do it from the familiar Opera user interface without restarting.

opssl6.dat contain the cipher suite settings, the root repository list, and the detected TLS capabilities + HSTS for each server. The detected capabilities are deleted when sensitive data are deleted by delete private data

As for the unrelated "Fatal Error #50" we have discovered that corruption of the opcacrt6.dat file can also cause this error code. If this is the reason, the best way to solve it is to delete that file while Opera is shut down, it will be regenerated (although private Roots will have to be reinstalled locally).