1390183 - certificate error pages: firefox doesn't notice when the system time has been corrected

Status: RESOLVED WORKSFORME

(Firefox :: Security, defect)

Description

[cgroswird]

Attachment: Screen Shot 2017-08-14 at 9.08.08 AM.png

Comment 1

[cgroswird]

Attachment: Screen Shot 2017-08-14 at 9.08.15 AM.png

Comment 2

[Eric Rescorla (:ekr)]

Additional notes (per conversation with Cate)

1. This was after a reboot with an apparent system update (apple + status bar)
2. Problem went away after browser restart.

Keeler, bouncing this to you for now.

Comment 3

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Hmmm - I suspect this happened something like this:

1. system update/reboot -> clock gets set to some time in the past
2. Firefox tries to connect to a site, certificate verification fails due to the clock
3. Firefox puts together the error page, asks for the system time ( https://dxr.mozilla.org/mozilla-central/rev/5322c03f4c8587fe526172d3f87160031faa6d75/browser/base/content/content.js#471 )
4. ntp or the equivalent kicks in and sets the system time to the correct value
5. Firefox displays a certificate error page with out-of-date information, given that the system clock has been corrected
(6. viewing the system clock widget indicates that it now has the correct time)

At that point, refreshing the page should work - perhaps we could add something to the error page that refreshes it when the system clock changes (more than due to the passage of time, that is)?

In any case, I'm pretty sure this is a front-end issue (rather than PSM).

Comment 4

[Eric Rescorla (:ekr)]

You're right, we should have reloaded. Too late now, though.

Comment 5

[Daniel Veditz [:dveditz]]

I set my date back a couple years,
loaded a secure site 
   ==> got an error equivalent to the screenshot,
turned automatic datetime setting on my system,
refreshed page
   ==> site loaded fine

This is working fine. not worth having the error page poll the clock on the chance it can auto-refresh. Most of the time the clock is that wrong it's going to stay that wrong.