"SSL Protocol Error" in Chromium for several Google web sites after installing Ubuntu Security Updates for libnss3

[Ricardo Dias Marques]

Scenario: Laptop computer running Ubuntu 12.04.5 LTS (64-bit) ("Precise Pangolin")

Issue: In the Chromium web browser - "Version 37.0.2062.120 Ubuntu 12.04 (281580) (64-bit)" - after having installed the Ubuntu security Updates that were available on Feb 18, 2016, I get the following error while trying to access some Google Web sites (e.g. https://www.google.com ; https://plus.google.com/ ; https://hangouts.google.com/ ):

----------------------------------------
SSL connection error

Unable to make a secure connection to the server. This may be a problem with the server, or it may be requiring a client authentication certificate that you don't have.
Error code: ERR_SSL_PROTOCOL_ERROR
----------------------------------------

Those web sites still appear correctly in the same computer, using other web browsers, namely Google Chrome - "Version 48.0.2564.109 (64-bit)" - or Mozilla Firefox - version "44.0.2"

The updates installed on Feb 18, 2016 were the following:

libnss3:amd64 (3.19.2.1-0ubuntu0.12.04.2, 3.21-0ubuntu0.12.04.1)
libnss3:i386 (3.19.2.1-0ubuntu0.12.04.2, 3.21-0ubuntu0.12.04.1)
libnss3-1d:amd64 (3.19.2.1-0ubuntu0.12.04.2, 3.21-0ubuntu0.12.04.1)

"libnss3" is listed at http://packages.ubuntu.com/search?keywords=libnss3 as being the "Network Security Service libraries", so I believe it's possible that update may be related to this issue that I'm facing.

ProblemType: Bug
DistroRelease: Ubuntu 12.04
Package: chromium-browser 37.0.2062.120-0ubuntu0.12.04.1~pkg917
ProcVersionSignature: Ubuntu 3.13.0-77.121~precise1-generic 3.13.11-ckt32
Uname: Linux 3.13.0-77-generic x86_64
NonfreeKernelModules: nvidia wl
ApportVersion: 2.0.1-0ubuntu17.13
Architecture: amd64
Date: Sat Feb 20 03:37:51 2016
EcryptfsInUse: Yes
ExecutablePath: /usr/lib/chromium-browser/chromium-browser
InstallationMedia: Ubuntu 12.04.2 LTS "Precise Pangolin" - Release amd64 (20130213)
MarkForUpload: True
ProcEnviron:

SourcePackage: chromium-browser
UpgradeStatus: No upgrade log present (probably fresh install)
modified.conffile..etc.default.chromium.browser: [deleted]

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[malangaman (cahevia)]

Any work around? Can we revert to the old: libnss3:i386 (3.19.2.1-0ubuntu0.12.04.2, 3.21-0ubuntu0.12.04.1)?

[B. C. Schmerker (bcschmerker)]

[b]Concerning this Bug,[/b] the ERR_SSL_PROTOCOL_ERROR issue specifically affects Alphabet Corporation properties (viz., Google® Search℠, Google+®, Google® Hangouts℠, YouTube℠); I had little trouble logging into SingSnap® from chromium-browser 37.0.2062.120-0ubuntu0.12.04.1~pkg917. My own Ubuntu® 12.04.5-LTS rig as updated with packages related to Kernel 3.13.0-generic has the following Release and APT Cache data concerning chromium-browser:
[code]$ lsb-release -a
Distributor ID: Ubuntu
Description: Ubuntu 12.04.5 LTS
Release: 12.04
Codename: precise
$ uname -a
Linux hotrodgpc-desktop 3.13.0-78-generic #122~precise1-Ubuntu SMP Tue Feb 2 21:27:34 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
$ apt-cache policy chromium-browser
chromium-browser:
  Installed: 37.0.2062.120-0ubuntu0.12.04.1~pkg917
  Candidate: 37.0.2062.120-0ubuntu0.12.04.1~pkg917
  Version table:
 *** 37.0.2062.120-0ubuntu0.12.04.1~pkg917 0
        500 http://mirrors.us.kernel.org/ubuntu/ precise-updates/universe amd64 Packages
        500 http://mirrors.us.kernel.org/ubuntu/ precise-security/universe amd64 Packages
        100 /var/lib/dpkg/status
     18.0.1025.151~r130497-0ubuntu1 0
        500 http://mirrors.us.kernel.org/ubuntu/ precise/universe amd64 Packages
[/code]
Incidentally, has a Bug been opened for libnss3 and/or libnss3-1d, which appear directly related to the ERR_SSL_PROTOCOL_ERROR issue?

[DiagonalArg (diagonalarg)]

Also affecting reddit, superuser, stackexchange, opentrackers.org - probably others.

[Devesh Bajpai (devesh77777)]

In chromium browser under SSL servers, I see various google servers are kept as unsupported.

[Morgothzz (morgothzz)]

A temporarily solution is;

Open synaptic
type/find libnss3
Select libnss3 2:3.21-0ubuntu0.14.04.1 (or similar file)
Go to package-force version (in the menu)
Select with the pulldown menu your previous version (mine was libnss3 2:3.15.4-1ubuntu7)
confirm with force version
Repeat this also for libnss3-nssdb
Then apply

When you downgrade these files you must temporarily lock both files

menu - package - lock version.

[beljoost (tempample)]

The latest version I can revert to is: 3.13.1.with.ckbi.1.88-1ubuntu6

Unfortunately the workaround Morgothzz suggests will result in removing Chromium, Icedtea, OpenJDK6, OpenJDK7 and several other packages. So this seems not to really be an option in my case.

I also wonder if this is a Chromium or Libnss3 issue?

btw. I'm running Mint Maya (based on Precise).

[medina9000 (medina9000)]

Experiencing the same bug in a fresh install of Ubuntu 15.10, after apt-get upgrade. And just to be clear, this is preventing users from visiting google.com using Chromium.

[Nicolas DS (zyphos)]

To retrieve the old versions of libnss3 and libnss3-d1 (Chromium works with them):

i386
http://launchpadlibrarian.net/233346598/libnss3_3.19.2.1-0ubuntu0.12.04.2_i386.deb
http://launchpadlibrarian.net/233346593/libnss3-1d_3.19.2.1-0ubuntu0.12.04.2_i386.deb

amd64
http://launchpadlibrarian.net/233346368/libnss3_3.19.2.1-0ubuntu0.12.04.2_amd64.deb
http://launchpadlibrarian.net/236292255/libnss3-1d_3.21-0ubuntu0.12.04.1_amd64.deb

Found through:
https://launchpad.net/ubuntu/precise/i386/libnss3

[rorschach (josanchezharo)]

I tried to do what Nicolas DS said, but when I download the packages I can't retrieve the old versions. I have the bug descrived for Chrome v41.0.2272.101 unknown (64-bit)

[beljoost (tempample)]

It seems to be a package issue, not a Chromium issue. At least on the Chromium tracker this issue has status: WontFix.

[quote]Based on the bug template, you've indicated you're running version "37.0.2062.120", which is no longer supported, and has a number of critical security bugs. You should upgrade to the latest version of Chrome, which is Chrome 48. If you're running a version provided by another party, such as your distro, please inform them that they're distributing an insecure version.[/quote]

https://bugs.chromium.org/p/chromium/issues/detail?id=588146

[Richard Hiltbrunn (rhiltbrunn)]

I'm using Ubuntu-Mate 14.04 64-bit. Having the same problem with Google Chrome.
I tried installing Chromium Version: 48.0.2564.82 from Ubuntu Software Center
Chromium is working fine. I'm able to search from google, something I wasn't able to do, as well as go to other google sites.
Looks like a fair workaround for me a this time.

[hd (hendra-klub)]

Same problem on ubuntu precise (12.04) 32bit.

[Cristiano Einar Silva do Amaral (cristianoeinar)]

palliative : google-chrome-stable --ssl-version-max=tls1

[beljoost (tempample)]

FWIW Updating Chromium to a more recent version is also subject of bug #1468666.

[Justin (jrmchenr)]

I had the same problem on the Mint 17 flavor of Ubuntu with the Chrome browser. Installing the newest Debian package from the chrome website fixed the issue (chrome 48.0.2564.116 32 -bit).

[Anthony Hamberg (ahamberg)]

Same problem on 12.04 / chromium. SSL error when trying to connect to google and other related sites. Also affects sites that use google content resources. Verified problem exists on 12.04 machine after feb. update to libnss3 version 2:3.21-0ubuntu0.12.04.2.

No problem on laptop 15.04 / chromium libnss3 2:3.19.2.1

[Anthony Hamberg (ahamberg)]

Edit to my previous comment: I failed to note very different versions of Chromium, the 12-04 machine runs Version 37.0.2062.120 while the 15.04 Version 48.0.2564.82
Tried and failed to update Precise to 48, it's supposed to work but terminates on start. As noted in bug referenced in comment #17.

I believe the correct solution is a (stable) Chromium 48 package for Precise as 37 is severely outdated and has security issues and is not compatible with libnss3 update.

[Doug Walker (i-launchpad-s)]

Add me to the list, same problem as everyone else with Ubuntu 12.04, which I, unfortunately, have to use.

[beljoost (tempample)]

This is not per se a duplicate of bug #1520568. That bug is older; affects 16.04; and has a fix. This bug has similar symptoms, but is not solved by the same fix.

Because the older bug has a status -fixed-. By marking this bug a duplicate of the older bug this new bug will never get attention or even get fixed.

[davygrvy (davygrvy)]

The duplicate claim is WRONG. Please detach. This is something else.

As far as I can determine, the root cert expired April 2014. WTF?

[davygrvy (davygrvy)]

Chrome->Settings->Manage Certificates (screenshot)

[hd (hendra-klub)]

It's fixed after last update.
chromium-browser:
  Installed: 37.0.2062.120-0ubuntu0.12.04.2
  Candidate: 37.0.2062.120-0ubuntu0.12.04.2
  Version table:
 *** 37.0.2062.120-0ubuntu0.12.04.2 0
        500 http://security.ubuntu.com/ubuntu/ precise-security/universe i386 Packages
        100 /var/lib/dpkg/status
     37.0.2062.120-0ubuntu0.12.04.1~pkg917 0
        500 http://id.archive.ubuntu.com/ubuntu/ precise-updates/universe i386 Packages
     18.0.1025.151~r130497-0ubuntu1 0
        500 http://id.archive.ubuntu.com/ubuntu/ precise/universe i386 Packages

Great work, thank you guys.

[ivan t (iveskins)]

Fixed for me after last updates.
THANKS!

[t0p (mtop6867)]

Ooops!! Stupid luser didn't check if there were any more updates other than the ones I did earlier. Chromium-browser google problem IS fixed. Great work guys, sorry for my bufoonery. I'm very happy, I can quit using Firefox again. Thanks thanks thanks fixers!! :)

[sitmex (puertas-oscar)]

FIxed for me after

sudo apt-get update and
sudo apt-get dist-upgrade

Using:
Google Chrome Version 48.0.2564.116 on
Ubuntu 14.04.4 LTS

Thanks fix(er[s]) team!

[Richard Foley (richard-foley)]

Running Open Suse 13.2 and using Firefox and Chrome successfully with https for years. Several days ago, started to get SSL errors on ANY GOOGLE SEARCH (wtf?)
Updated system using zypper, errors still there:

  Version 39.0.2171.95 (64-bit)

  SSL connection error

  Unable to make a secure connection to the server. This may be a problem with the server, or it may be requiring a client authentication certificate that you don't have.
  Error code: ERR_SSL_PROTOCOL_ERROR

This stonks...

[medina9000 (medina9000)]

Still a problem on Chromium Version 45.0.2454.101 Ubuntu 15.10 (64-bit)

[Hedley Finger (hedley-finger)]

Bizarrely, no problems as reported above with Chromium Version 48.0.2564.116 running on Toshiba Satellite C660 i386 32-bit laptop with Ubuntu 14.04 (actually 14.04.4), but I am getting this ERR_SSL_PROTOCOL_ERROR problem with Chrome Version 42.0.2311.90! No problems with Firefox.

Chrome was installed from an old .deb on the hard disk. I tried downloading chrome-stable-current but Google's download page is broken.

[Alexander (ustimenko-alexander)]

Installing latest google-chrome from google.com/chrome helped:

    wget https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb && sudo dpkg -i google-chrome-stable_current_amd64.deb

[Tony Tran (usefulpcguide)]

I think sometimes, it's not an issue that come from Chrome at all. I faced this issue last week and found this guide on Google, which helped me to resolve it.

Check it out!

https://usefulpcguide.com/16820/fix-err_ssl_protocol_error-google-chrome/

[Shi Yali (shiyali2)]

It looks like this bug has returned on 7/13 after the latest updates.

[Shi Yali (shiyali2)]

libnss3 was updated from 3.21 to 3.23 on Tuesday July 12.

[Amit Parik (amit-parik)]

Same error faced after today's updated on my laptop.
Description: Ubuntu 12.04.5 LTS
Release: 12.04
Codename: precise

Please check latest release .

Thank you!

[Mike Krall (mkrall-wyo)]

Having same problem... all Google related non-functional... ERR_SSL_PROTOCOL_ERROR... same as in Feb. 2016 after libnss3 update.

Still not fixed after new 12.04 download 7-14. This bug shows it as "fix released" at the top of this page. Is it required to start a new bug report even if the bug seems the same?

[Shi Yali (shiyali2)]

Fix has been released. Thank you very much!

[lively (doratheexplorer)]

I have been experiencing SSL certificate errors since latest Ubuntu security update when using Chromium. Firefox does not have the same issues.

[Bryan (what-ever)]

I to have started to have SSL certificate errors with Chromium. Chrome and Firefox are OK.

[monochromec (monochromec)]

Can confirm that this issue has surfaced once again after the update to 17.04.

[Olivier Tilloy (osomon)]

@monochromec and others: are you still seeing the issue with the latest chromium update (60.0.3112.78)?

[monochromec (monochromec)]

Sorted as Chromium was accidentally using Firefox's libnss3 library. After a suitable tweaking it's fixed.