1166348 - sede.educacion.gob.es PKI personal digital certificate authentication (login) requires unsafe renegotiation

Status: RESOLVED WORKSFORME

(Web Compatibility :: Site Reports, defect)

Description

[ivanagui2]

User Agent: Mozilla/5.0 (Windows NT 6.3; rv:38.0) Gecko/20100101 Firefox/38.0
Build ID: 20150513174244

Comment 1

[ivanagui2]

When trying to login to my account at https://sede.educacion.gob.es/ with SSL certificate I get error:

Secure Connection Failed        
          An error occurred during a connection to www.myopenid.com.
Renegotiation is not allowed on this SSL socket.
(Error code: ssl_error_renegotiation_not_allowed)

Using mozilla binary
Mozilla/5.0 (Windows NT 6.3; rv:38.0) Gecko/20100101 Firefox/38.0

Comment 2

[csaba.klinger]

Connecting web sites using old TLS/SSL versions, I get the next error message:

 "ssl_error_renegotiation_not_allowed"

It seems, that the Firefox 38.0.1 does not support the workarounds (any more?) described the web site below:

https://wiki.mozilla.org/Security:Renegotiation

Comment 3

[Chris Thompson]

Hello! I'm getting the same thing that I believe started at Firefox 38.0.-something [38.0.5 currently].

I can use older versions (V24 was handy, so I tried that and it still works with the site).

I have spoken to the admins, and hopefully they'll be updating firmware and turning off SSL renegotiation, but I wanted to say I've been trying the old workarounds and they do not work any more.

Specifically: I have the host name specified in security.ssl.renego_unrestricted_hosts (same settings that worked prior to upgrade). I am also using a client certificate.

Seems odd the setting would still appear but not be effective...makes you wonder if it's a bug, or just that FF finally removed this old workaround and hasn't updated the docs.

My build is: https://hg.mozilla.org/releases/mozilla-release/rev/f6680de4071d

Regards,
Chris

Comment 4

[:Cykesiopka]

(In reply to csaba.klinger from comment #2)
> Connecting web sites using old TLS/SSL versions, I get the next error
> message:
> 
>  "ssl_error_renegotiation_not_allowed"
> 
> It seems, that the Firefox 38.0.1 does not support the workarounds (any
> more?) described the web site below:
> 
> https://wiki.mozilla.org/Security:Renegotiation

After Bug 1123020, no.

If you run into a broken site, your best option is probably to try and persuade whoever runs the site to fix the server.

I'll update the wiki page later if nobody else beats me to it.

Comment 5

[:Cykesiopka]

(In reply to Chris Thompson from comment #3)
> I have spoken to the admins, and hopefully they'll be updating firmware and
> turning off SSL renegotiation, but I wanted to say I've been trying the old
> workarounds and they do not work any more.

Thanks for taking the time to do that.

Comment 6

[:Cykesiopka]

At the moment, I'm not aware of any plans to revert the change in Bug 1123020, so I'm going to morph this into a Tech Evangelism bug.

Comment 7

[ivanagui2]

(In reply to ivanagui2 from comment #1)
> When trying to login to my account at https://sede.educacion.gob.es/ with
> SSL certificate I get error:
> 
> Secure Connection Failed        
>           An error occurred during a connection to www.myopenid.com.
> Renegotiation is not allowed on this SSL socket.
> (Error code: ssl_error_renegotiation_not_allowed)
> 
> Using mozilla binary
> Mozilla/5.0 (Windows NT 6.3; rv:38.0) Gecko/20100101 Firefox/38.0


Sorry, the error message is not that. The correct one is:

Conexión segura fallida

Ha ocurrido un error durante una conexión a sede.educacion.gob.es. No se permite la renegociación en este socket SSL. (Código de error: ssl_error_renegotiation_not_allowed)

Comment 8

[Enrique]

Same problem with https://papas.educa.jccm.es/

Message
"Conexión segura fallida
Ha ocurrido un error durante una conexión a papas.educa.jccm.es. No se permite la renegociación en este socket SSL. (Código de error: ssl_error_renegotiation_not_allowed)"

In january 2015 solved this way
https://www.mozilla-hispano.org/foro/viewtopic.php?f=2&t=13788

But now security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref does not appear in firefox v38.0 ubuntu

Comment 9

[Masatoshi Kimura [:emk]]

https://sede.educacion.gob.es/ and https://papas.educa.jccm.es/ no longer require unsafe renegotiation.
A certificate error will be displayed, but it is overridable.

Comment 10

[ivanagui2]

https://sede.educacion.gob.es/ and https://papas.educa.jccm.es/ require unsafe renegotiation to identify themselves with a digital certificate (login).

Comment 11

[ivanagui2]

https://sede.educacion.gob.es/ and https://papas.educa.jccm.es/ require unsafe renegotiation to identify themselves with a digital certificate ("Iniciar sesión con certificado" and "Acceso con Certificado Digital", respectively).

Comment 12

[ivanagui2]

Attachment: SSL Report: sede.educacion.gob.es

https://www.ssllabs.com/ssltest/analyze.html?d=sede.educacion.gob.es

Comment 13

[ivanagui2]

Attachment: SSL Report: papas.educa.jccm.es

https://www.ssllabs.com/ssltest/analyze.html?d=papas.educa.jccm.es

Comment 14

[ivanagui2]

Attachment: sede.educacion.gob.es-ssl_error_renegotiation_not_allowed.PNG

sede.educacion.gob.es Código de error: ssl_error_renegotiation_not_allowed

Comment 15

[ivanagui2]

Attachment: papas.educa.jccm.es-ssl_error_renegotiation_not_allowed.PNG

Comment 16

[Karl Dubost💡 :karlcow]

http://sede.educacion.gob.es/ is redirecting to 
https://sede.educacion.gob.es/ which is still not secure.

Maybe a way to contact them is through 
http://www.mecd.gob.es/portada-mecd/

Their twitter account is active
https://twitter.com/educaciongob

I'll put this as contactready, if you decide to contact them, please switch to sitewait

Comment 17

[ivanagui2]

https://sede.educacion.gob.es/ now supports Secure Renegotiation. Resolved.