1036641 - Java applets using https with wrong certificate

Status: RESOLVED INVALID

(Core :: Security, defect)

Description

[u502197]

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:32.0) Gecko/20100101 Firefox/32.0 (Beta/Release)
Build ID: 20140709004001

Steps to reproduce:

I access to a goverment website using https and a personal certificate. This website, in certain pages, uses java applets located in the same domain https://domain.com and some applets located in https://1.2.3.4 (with the same certificate of https://domain.com, so it's a wrong certificate for ip address 1.2.3.4).  
I have no control over this website, I'm just a user.




Actual results:

Firefox 29 showed a warning about the applets in https://domain.com and https://1.2.3.4 but gave me the option to continue, and the applets were executed.
Firefox 30 shows a warning for applets located in the same domain (https://domain.com), but the webpage doesn't work. 
I think that Firefox doesn't try to execute the applets located in https://1.2.3.4


Expected results:

Firefox 30 should show a warning about the java applet located in https://1.2.3.4, with the option to execute the applet.
I have switched back to Internet Explorer 11, it shows a warning about the applets with "Location: https://domain.com, https://1.2.3.4" with the option to continue.

Comment 1

[John Schoenick [:johns]]

What warning, specifically, are you seeing? This sounds like a warning generated by java, which is not, IIRC, something we have any influence over. A test case would be helpful, of course.

Comment 2

[Kyle Machulis [:qdot] [:kmachulis] (INACTIVE)]

The HTML <applet> element and related java functionality was removed from Gecko in Bug 1279218. Marking related bugs as invalid.