156580 - Error Establishing an Encrypted connection

Status: VERIFIED DUPLICATE of bug 111384

(Core Graveyard :: Security: UI, defect, P3)

Description

[Stewart Smith]

When trying to log into the roxio store, (behind a squid proxy server, running
on RedHat Linux 7.2) from either Mozilla (1.0, 1.1a on Linux) or IE (on W2K) we
get a "Error establishing an encrypted connection to www.portablestore.com.
Error Code: -5933." dialog appearing.

(From memory), this also has happenned with a few other sites using ssl. I'll
attempt to find some and ammend the bug. But this is a real showstopper.

The funny thing is, it works with Netscape 4.77 (through the proxy).

The squid package is: squid-2.4.STABLE6-6.7.3

Comment 1

[Stewart Smith]

Also seems to be happenning when trying to visit:

http://www.redhat.com/apps/redirect.apm/apps/support/?rhpage=/index.html/horizontal_nav**

Comment 2

[Stewart Smith]

Seems to be working in the nightly build.

Comment 3

[Stewart Smith]

Found it happenning in the Current (yesterday's build) on https://olb.westpac.com.au

Comment 4

[Stewart Smith]

I've also filed a squid bug related to this one (i.e. it's the same problem, but
it seems as though it *might* be more squid related than mozilla). The bug
number is 379.

http://www.squid-cache.org/bugs/show_bug.cgi?id=379

Comment 5

[Noel Clarkson]

Using build 2002053012, behind a firewall using a squid cache (RH7.0), this 
happens to our install of just the browser and the security stuff, but works 
fine for the install of everything.  What are others setups?  Both these 
machines are behind the same firewall and squid so it seems that Mozillia might 
still be at least part of the problem.

Comment 6

[Stewart Smith]

Still happenning on complete install of nightly build 20020730 on Debian Woody 686.

Comment 7

[Eric L.]

I confirm the problem on Windows 2000 with Moz 1.1 Mozilla/5.0 (Windows; U;
Windows NT 5.0; en-US; rv:1.1) Gecko/20020826.

Behind the firewall of HP (no idea which software), trying to reach some
online banking sites, I get the same error message (but with -5985). Just to not
give away my banking companies, I tried at banking.wellsfargo.com and it didn't
work. Nevertheles I can log on my provider's site (who has Apache installed).
With the same setup and IE5.5 I do come through.

So perhaps something to do with the encryption mechanism used!?

Hope this helped.

Comment 8

[Eric L.]

Hello again,

I did some more testing and my problems were due to OCSP validation being on for
certificate presenting a such field. I don't know if the field present in the
certificates was wrong or if the validation couldn't be done because of the
firewall but without the validation, the problem is gone. So fine for me.

Thanks, Eric

Comment 9

[Craig Stephen]

I received this error ("Error establishing an encrypted connection") 
with error code -5985; turning off OCSP validation made the problem
go away.  I did not investigate whether the cert was presenting an
OCSP URL, nor my ability to connect to such an URL given my current 
browser & network configuration.

Perhaps this is just a matter of needing a more descriptive
error message for code "-5985" - e.g. "unable to validate certificate
<cert> at OCSP URL <OCSP URL>" or some such thing.

Comment 10

[Harold E. Russell]

Confirmed: turning off OCSP validation eliminates the error.
Site: http://www.jasc.com/catalog.asp?
Using:
Mozilla 1.1
Mozilla/5.0 (Windows; U; Win 9x 4.90; en-US; rv:1.1) Gecko/20020826
Seconding:  the suggestion for more descriptive error messages.

Comment 11

[Noel Clarkson]

Yep fixed it for me also.  Not sure how it got turned on in one browser install
and not the other when I don't think I did anything different, but this fixed
it.  I'll third the error message change - it's taken a large amount of time
trying to find the solution to this one. 

I'll post this possible fix to the squid bug that's mentioned in comment #4 also.

Comment 12

[Stewart Smith]

Changing the setting also makes things work for me now. Although, there should
be a more precise definition of the error, and the option to continue through.
Also, it shouldn't really take that long before the error message appears.

Comment 13

[gordon]

This bug is not related to the mozilla cache.  Changing component.

Comment 14

[John Unruh]

Duplicate

Comment 15

[John Unruh]

*** This bug has been marked as a duplicate of 111384 ***

Comment 16

[John Unruh]

verified dupe.