1164941 - https://aus4.mozilla.org uses SHA-1 cert, which triggers warning in Browser Console: "This site makes use of a SHA-1 Certificate; it's recommended you use certificates with signature algorithms that use hash functions stronger than SHA-1"

Status: RESOLVED INCOMPLETE

(AUS Graveyard :: Systems, defect)

Description

[Daniel Holbert [:dholbert]]

STR:
 1. Start a new Firefox Session at about:blank
 2. Open Browser Console (ctrl shift J)
 3. EITHER: directly visit https://aus4.mozilla.org/
    OR type "update.xml" into the Browser Console filter bar, and wait for a few minutes for an update ping to happen.

ACTUAL RESULTS:
A warning message appears:
{
This site makes use of a SHA-1 Certificate; it's recommended you use certificates with signature algorithms that use hash functions stronger than SHA-1.[Learn More]
}
with a URL that links to something hosted on https://aus4.mozilla.org/.

EXPECTED RESULTS: No such warning. (If this is something we see fit to spam a warning about for each resource-load, we should make sure our own servers don't trigger this warning.)

Comment 1

[Daniel Holbert [:dholbert]]

The "Learn More" link points to
 https://developer.mozilla.org/en-US/docs/Security/Weak_Signature_Algorithm
...which has a further link to this blog post from last September:
 https://blog.mozilla.org/security/2014/09/23/phasing-out-certificates-with-sha-1-based-signature-algorithms/

Comment 2

[Augustin Trancart [:autra]]

If SHA-1 is really weak, then it is very dangerous to ship flame OTA updates through it.

Comment 3

[scottsmith1]

+1 on removing that warning

I'm using the SHA1 library, but not for anything security related.

My users are now getting spammed with messages implying I've done something insecure relating to certificates.

I'm using SHA1s as an ID in a content-addressable storage system.  Speed is important, so changing to SHA256 for my application would be worse.

Comment 4

[Daniel Holbert [:dholbert]]

(In reply to scottsmith1 from comment #3)
> +1 on removing that warning

This bug isn't about the warning in general, or about removing that warning -- this bug is about fixing our AUS servers to not use SHA-1 certificates.

If you'd like to propose that the warning be removed, or fixing it so that it doesn't get spammed in your particular non-security-related use-case, please file a separate bug (chained off of bug 1068949), and CC mgoodwin. (assignee of bug 1068949)

Comment 5

[Takanori MATSUURA]

This bug lies at rest in the graveyard.