793369 - blog.mozilla.org uses invalid SSL certificate

Status: RESOLVED WORKSFORME

(Infrastructure & Operations Graveyard :: WebOps: Other, task)

Description

[Frank Wein [:mcsmurf]]

When I go to blog.mozilla.org or blog.mozilla.com, I get an invalid SSL cert warning as that website redirects me to https://blog.mozilla.org. https://blog.mozilla.org uses a SSL cert that was created for blog.mozilla.com though:
"blog.mozilla.org uses an invalid security certificate.
The certificate is only valid for blog.mozilla.com
(Error code: ssl_error_bad_cert_domain)"

Comment 1

[Frank Wein [:mcsmurf]]

Actually I think this bug belongs in this component as Bug 782228 was also filed there. Bug 782228 was resolved as WFM though a few weeks ago, not sure why.

Comment 2

[Frank Wein [:mcsmurf]]

Attachment: openssl output

This is the output from the "openssl s_client -showcerts -connect blog.mozilla.org:443" command (via Cygwin command line on Windows).

Comment 3

[mjh563]

Does it work if you enable this:

Options > Advanced > Encryption > Use TLS 1.0

Comment 4

[Chris Turra [:cturra]]

:mcsmurf - our load balancer uses hostname matching, which requires support of the TLS 1.0 'server name indication'. without TLS 1.0 enabled, this would explain why your browser is receiving the blog.mozilla.com certificate (similar to your openssl s_client attempt.

[e-mail] comment looks to be on the right track here.

Comment 5

[Frank Wein [:mcsmurf]]

Indeed, seems to work now. I did not enable TLS though (it was already enabled), I just restarted my browser. Strange, resolving as wfm. BTW: Even with TLS 1.0 enabled, the cert check fails in Internet Explorer 8. But maybe IE 8 did not implement the standard correctly.

Comment 6

[Frank Wein [:mcsmurf]]

To respond to myself: IE 8 under WinXP does not support server name indication, Windows Vista or higher is required for that.