SSL Certificate from 'localhost'

[RealBlackStuff]

Since a few days my Windows XP does a strange thing.
When I pay with a credit card on a secure website, I get a warning about an expired Security Certificate, issued by 'localhost'.
I'm using Firefox 2.0.0.14.

Going into about:config I find this:
security. default_personal_cert
Determines the selection of a security certificate to present to web sites that require one.
Select Automatically (default): Automatically choose the certificate
Ask Every Time: Prompt user with a choice of certificate options every time
Note: In Firefox, this can be changed via "Tools → Options → Advanced → Certificates → Client Certificate Selection"

My entry has/was changed to: Ask Every Time.
Anybody knows HOW or WHY?

I have changed it back to the (default), and wait and see what happens next time.

The only change I can think of, that may have caused this, is installing Apache/MySQL/PHP on my PC to run a trial of the 'ZenCart' shopping cart.
To make that work I had to enter 3 new lines in my hosts file:

# ZenCart entries
127.0.0.1 www.example.com # For browser access
127.0.0.1 mail.example.com # For email access
127.0.0.1 example.com # For mercury mail server

Does this ring a bell for any of you?

[davidspalding]

Stop shopping at those sites. Any site that serves a cert issued by "localhost" during checkout is highly, highly suspect.

-OR-

Update your antivirus and anti-spyware software and do a complete scan. Though unlikely, I wonder if you've got a Trojan that is intercepting https calls to commerce sites, routing it to a local program, which is using an invalid certificate. Firefox could be alerting you that you are being hitting with a man-in-the-middle attack coming from your own localhost.


Your hosts file looks benign. A third party commerce site shouldn't be redirecting to your local Apache installation.

[RealBlackStuff]

Have not yet had the issue again, but then, I did not buy anything since the change-back.

I have no spyware or trojans of any kind on my PC, checked and double-checked and then checked again.

[RealBlackStuff]

Found the culprit.
Apache starts automatically at bootup, instead of manually, and this produces the 'localhost' SSL-cert message.

Removing the 'autostart' solved the problem.
Pfhui!