2

I'm in a private network, where everything runs on a proxy, that uses a HTTP, the phone/tablet isn't rooted. On Orbot, I have put in the address, I have put in the ports and all the bridges too. However when I try to run the Orbot browser I get an error that says SSL Error 3. (For more info, YHGFL are the ones that are blocking websites such as reddit.) So if anyone can help, much appreciated.

Improve this question
3
  • Not an answer, just that I'm getting the same and cant find out why. Monitoring.
    – user5352
    Commented Dec 22, 2014 at 13:09
  • As far as I can figure, orweb wants to run https. Error 3 basically says that the site you're on has responded that it can run https (a secure connection), but that there is something wrong with the certificate that it's presenting. Fine, I can deal with that. I'm not going to enter any info that is confidential. BUT... orweb won't let me make an insecure connection. Enter http://... and orweb converts it to https. It doesn't show me the cert and ask if I want to grant an exemption. No, the developers are much smarter than am, and must protect me from myself.
    – user6794
    Commented Feb 24, 2015 at 1:44
  • Pretty much all the sites I visit are blocked by orweb/orbot making the application absolutely useless. The reasons some sites do not conform to this certificate issue is very acceptable to me.
    – user9528
    Commented Oct 1, 2015 at 11:44

2 Answers 2

Reset to default
1

In such cases proxies usually performing at least one of the bad tricks like that:

  • MitM attack by intruding into SSL/TLS connecions. Tor will give you an error because for directories it has hardcoded keys and on another screinario proxy just ruins the SSL handshake that it can't intervene into
  • by-ip blocklists for Tor entry guards and directories. Instead of the full list of Tor nodes, a list of directories and entry guards is relatively manageable to block by ip. Your connection will just die when trying to connect to these addresses - or maybe you'll see a 403 error
  • filtering remote/destination ports. If you're trying to connect to the port which is not in the "white list"/"allowed ports list" - it just dies or gets you 403

All this stuff makes it harder to use Tor, but you should try meek, obfs3 or obfs4 pluggable transports and bridges. This can help you. If they are blocking bridges too - try to use an unpublished bridge on port 443 with obfs3 or obfs4 - you can even make your own

Improve this answer
0

Orbot has no interface for errors in SSL/TLS connections. So in case there is a wrong or unknown certificate it just drops the connection and shows this error message. When you visit the page with some other browser, you'll see a certificate warning.

The Guardian project works on integrating Firefox as a mobile browser. When this is deployed, you'll see the warning you're used to.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .