Closed Bug 110842 Opened 24 years ago Closed 24 years ago

Unknown SSL error (-8073)

Categories

(Core Graveyard :: Security: UI, defect, P3)

Product:
Core Graveyard
Component:
Security: UI
Version:
Other Branch
Platform:
x86
All
Type:
defect

Tracking

(Not tracked)

Status:
VERIFIED FIXED
Milestone:
psm2.2

People

(Reporter: ecooper, Assigned: rangansen)

References

(
URL
)

Details

(Keywords: ecommerce)

In whatever version is in Mozilla 0.9.5, when I attempt to access the URL, I get a dialog box with "You cannot connect to bnyonline.com because of an unknown SSL error (-8073)"
SEC_ERROR_OCSP_BAD_HTTP_RESPONSE That would be because you've enabled ocsp, and the ocsp responder send a bad response. Please check in prefs->sec&priv->validation that you're not using ocsp.
Assignee: ssaux → rangansen
Status: UNCONFIRMED → NEW
Ever confirmed: true
Priority: -- → P3
Target Milestone: --- → 2.2
Right, I was using "...only for OSCP service URL". But that means OCSP should work in that case, right?
OK, I get the same error (at https://www2.cucanb.com.au/) using Mozilla 0.9.6 on MacOS 9.1 & on RedHat 7.1. This is with the "...only for OSCP service URL" setting on. I guess the error message should changed to something like "This site's OCSP Certificate Validation failed. You can turn off OCSP in Preferences, under Privacy & Security->Validation."
I've been using 0.9.5 for weeks and this morning I wasn't able to login to my.yahoo.com because of the bug. global.secure.yahoo.com is the site and my validation preference is set to "Use OSCPto validate only certificates that specify an OCSP service URL" In addition, I could not login to mysun.sun.com this morning because of a similar error: unknown SSL error (-5973). It's odd that I've been able to access all of these sites in the past and as recent as yesterday and now it get repeated and repeatable errors. I also noticed a couple of other similar bugs have been reported, are these all related?
In reguard to my previous comment I'm running Mandrake Linux 8.0. uname -a Linux rogue.dmi.com 2.4.3-20mdk #1 Sun Apr 15 23:03:10 CEST 2001 i686 unknown
I likewise get an error using the OSCP for sites which specify only pref, at www.webcertificate.com, this time "Unknown SSL error (-8061)" on win98se with moz .9.6. Saying to not use OSCP allows access, but...
Please make this a more friendly error. I just got this trying to access firstusa.com, a *major* credit card company. I had to search for 8073 in bugzilla to figure out what is wrong. I never had this problem with firstusa.com before using 0.9.7, but don't know if that's the cause. An option to accept the certificate anyway would probably be nice (its done with other failures of certs, right?) I wouldn't think netscape would want to release a product that says "Unknown error #" to the general public.
Keywords: ecommerce
Changing OS to "All", since it appears on Linux as well as Windows. This also occurs when logging into the PacBell online account manager, and on some of the SourceForge HTTPS pages.
OS: Windows 2000 → All
*** Bug 112915 has been marked as a duplicate of this bug. ***
*** Bug 113649 has been marked as a duplicate of this bug. ***
Well, there are 8 different places in parsing an OCSP response that SEC_ERROR_OCSP_BAD_HTTP_RESPONSE, but for both https://bnyonline.com/retail_login_check.asp and https://www.pacbell.com/authenticate/ (where the problem is only intermitent) it's because the OCSP server sends back an HTTP header but no data. The header looks like: HTTP/1.1 200 OK Server: Netscape-Enterprise/3.6 SP2 Date: Tue, 08 Jan 2002 09:28:39 GMT Content-type: application/ocsp-response Content-transfer-encoding: Binary Content-length: 5 but no data follows; when it works, there's gobs of binary data. Either the OCSP servers or buggy, or not returning any data (even after giving the content length header a value of 5) is a valid response that we need to deal with.
These should be fixed by patch to bug# 107491 - should display proper error messages in almost all cases - still might display error codes sometime [in addition to the error message] like cases where multiple error codes map into one error message [eg, in cases of ocsp responses which are bad or malformed or of an unknown type, etc] to ensure no loss of info.
Status: NEW → RESOLVED
Closed: 24 years ago
Resolution: --- → FIXED
So when a OCSP site does return a bad response, should we open up an evanglism bug, or what?
Hmm.. well, I believe so... cc-ing Nelson for comments....
Verified.
Status: RESOLVED → VERIFIED
*** Bug 124321 has been marked as a duplicate of this bug. ***
Product: PSM → Core
Product: Core → Core Graveyard
You need to log in before you can comment on or make changes to this bug.