733100 - HTTPS is broken at https://mozillalabs.com/

Status: RESOLVED FIXED

(Websites :: mozillalabs.com, defect)

Description

[alex_mayorga]

There's mixed content on https://mozillalabs.com/ that breaks HTTPS.

The page has these http:// resources:
http://mozillalabs.com/files/2011/07/webfwd_badge.png
http://mozillalabs.com/wp-content/themes/labs_project/img/labkit-header.png
http://mozillalabs.com/wp-content/themes/labs2.0/img/submit-arrow.png

The https:// resources are available at:
https://mozillalabs.com/files/2011/07/webfwd_badge.png
https://mozillalabs.com/wp-content/themes/labs_project/img/labkit-header.png
https://mozillalabs.com/wp-content/themes/labs2.0/img/submit-arrow.png

Set the preference security.warn_viewing_mixed to true and you'll see the problem.

Comment 1

[Stephen Donner [:stephend] Not actively reading bugmail]

Jetpack/FlightDeck/Add-ons Builder links to https://jetpack.mozillalabs.com/sdk/latest/docs/, which has the same problem.

Comment 2

[Stephen Donner [:stephend] Not actively reading bugmail]

jetpack.mozillalabs.com uses an invalid security certificate.

The certificate is only valid for the following names:
  www.mozilla.com , mozilla.com  

(Error code: ssl_error_bad_cert_domain)

Comment 3

[Philippe M. Chiasson (:gozer)]

These .mozillalabs.com sites are hosted by webops resources, so it's not something I can fix in Labs, re-assigning.

Comment 4

[Jake Maul [:jakem]]

This seems to be 3 unrelated issues in one bug. Please try not to do this if possible, as it can cause some things to get fixed while others get overlooked. :)


1) https://mozillalabs.com/ redirects to /en-US/ for me, which does not seem to load any non-SSL resources (comment 0). Perhaps this was fixed already? In any case, we'd have to send this to the betafarm developers, as IT/webops does not control actual site content like this.

2) https://jetpack.mozillalabs.com/ does have a cert error. This is fixed (via TLS SNI, so most browsers will be fine).

3) The entirety of https://jetpack.mozillalabs.com/ is all 403/404. The non-SSL page redirects to https://addons.mozilla.org/en-US/developers/. I think this traces back to some recent SSL changes we had to make due to an expiring wildcard cert. I've fixed this for jetpack.mozillalabs.com, and will be opening another bug to investigate further.


I will move this back to Mozilla Labs for further investigation on issue #1.

Comment 5

[David Ascher (:davida)]

Confusingly enough, the mozillalabs site is not part of the Labs product group, but a Website codenamed Betafarm.

(We should rename that component, I'll see about getting that done).

cc'ing pmac who'se the dev on betafarm/mozillalabs.com

Comment 6

[Ben (:bensternthal)]

Responding to Jake Maul on issue #1.

This original bug was filed prior to the launch of the new site on April 16. That bug references a wordpress site that is no longer live and this issue is no longer valid.

I propose closing this bug and handling the jetpack issues as sep bugs.

Comment 7

[Jake Maul [:jakem]]

The jetpack issues (#2 and #3 from commetn 4) are both resolved already. Seems like there's nothing more to do here.... resolving.