1169528 - No favicon displayed for specific HTTPS site

Status: RESOLVED INCOMPLETE

(Firefox for Android Graveyard :: Favicon Handling, defect)

Description

[Alexander]

Firefox mobile don't load favicon.ico from my HTTPS website. File is OK. By HTTP - also OK. All other browsers (and Desktop Firefox) show all OK as well. To reproduce, try https://cctoo.org/favicon.ico - from the address bar it loads everything just fine. On site's logs I can see it also, but I don't see any attempts to download it from browser itself (for favicon's purpose). By the way, it shows favicons well from other HTTPS sources e.g. Wikimedia (I try to download only images from there - no HTML). BTW, network monitors show some faulty SSL connections with my site (I can't see anything more informative due to HTTPS). I know, that Firefox uses some separate way to communicate in favicon module, but it seems there is a problem with it. I can only guess, that it might concern IP address (My hosting provider uses shared IPs). If this module try to get icons by IP addresses instead of domain names - it's certainly not a good choice because will not work for such cases. But it's just an assumption.

Comment 1

[Michael Comella (:mcomella) [NI reported issues only: ex-Mozilla]]

Thanks for filing - I can reproduce.

Richard, are you the favicon master these days? Do you know what's going on here?

Comment 2

[Kevin Brosnan [Ex-Mozilla]]

I suspect that is happening because there is mixed content on the page? If you serve a page that has only https content does the favicon show?

Comment 3

[Richard Newman [:rnewman]]

My guess is that your version of Android ships an HTTP library that doesn't support a particular SSL feature on your site (cipher suite, self-signed cert, SNI, whatever).

Try loading https://cctoo.org/favicon.ico in the stock Browser app. If you get an error of any kind, then that's why.

It loads fine for me on my Lollipop device.

Failing that, yeah, check for mixed content issues, or grab an adb log and we can take a look.

Comment 4

[Alexander]

Try https://upload.wikimedia.org/favicon.ico - you should see the same icon in the middle of the screen and on the tab heading area.
Now try https://cctoo.org/favicon.ico - I can see it only in the middle (page area).
As for me, it's obviously not a SSL-related issue here - there is no html at all. But if you like - you can check other pages - the same thing happens there.
I've tested it on Samsung Tab Pro (Android 4.4.2) as well as on an old HTC smartphone (Android 4.0.3).

Comment 5

[Alexander]

Attachment: adb logcat (https://cctoo.org/favicon.ico on Fennec)

Errors reading favicon (SSLException)

Comment 6

[Alexander]

Got the log from Samsung tablet - it seems something with SSL handshaking. But all other (including stock) browsers show all fine.

Comment 7

[Richard Newman [:rnewman]]

For those who don't want to load a 2.2MB log file:


 Error reading favicon
 javax.net.ssl.SSLException: SSL handshake aborted: ssl=0x85911580: I/O error during system call, Connection reset by peer
 	at com.android.org.conscrypt.NativeCrypto.SSL_do_handshake(Native Method)
 	at com.android.org.conscrypt.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:406)
 	at android.net.SSLCertificateSocketFactory.verifyHostname(SSLCertificateSocketFactory.java:220)
 	at android.net.SSLCertificateSocketFactory.createSocket(SSLCertificateSocketFactory.java:469)
 	at org.apache.http.conn.ssl.SSLSocketFactory.createSocket(SSLSocketFactory.java:382)
 	at org.apache.http.impl.conn.DefaultClientConnectionOperator.openConnection(DefaultClientConnectionOperator.java:191)
 	at org.apache.http.impl.conn.AbstractPoolEntry.open(AbstractPoolEntry.java:167)
 	at org.apache.http.impl.conn.AbstractPooledConnAdapter.open(AbstractPooledConnAdapter.java:125)
 	at org.apache.http.impl.client.DefaultRequestDirector.executeOriginal(DefaultRequestDirector.java:1199)
 	at org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:661)
 	at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:564)
 	at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:491)
 	at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:469)
 	at android.net.http.AndroidHttpClient.execute(AndroidHttpClient.java:314)
 	at org.mozilla.gecko.favicons.LoadFaviconTask.tryDownloadRecurse(LoadFaviconTask.java:131)
 	at org.mozilla.gecko.favicons.LoadFaviconTask.downloadAndDecodeImage(LoadFaviconTask.java:248)
 	at org.mozilla.gecko.favicons.LoadFaviconTask.downloadFavicon(LoadFaviconTask.java:225)
 	at org.mozilla.gecko.favicons.LoadFaviconTask.doInBackground(LoadFaviconTask.java:438)
 	at org.mozilla.gecko.favicons.LoadFaviconTask$1.run(LoadFaviconTask.java:307)
 	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1112)
 	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:587)
 	at java.lang.Thread.run(Thread.java:841)

Comment 8

[Richard Newman [:rnewman]]

This means the connection's being dropped, not by the client. Things to try:

* Looking at the server logs.
* Enabling TLSv1.0 on the server (doesn't have to be permanently, but it might be failing there).
* If you're on cellular data, switch to wifi, or vice versa. (This can happen because of bad interactions with carrier DNS caching.)

Comment 9

[Alexander]

Log is too scanty there - I can see just nothing - no attempt from the client to load icon (when I try to load some page or png). One succesful attempt when https://cctoo.org/favicon.ico - to show it on page. I have no access to TLS settings - hosting provider doesn't allow it. Wifi doesn't help.

Comment 10

[Alexander]

Could it be the shared IP -issue, BTW?

Comment 11

[Richard Newman [:rnewman]]

It's not impossible. If the server uses SNI, things could fail, yes.

Comment 12

[Alexander]

So, is there any hope this module will be improved and will show favicons for such sites? I just don't believe I'm the only one who uses SNI.

Comment 13

[matze112]

Hello Alexander,
I'm fighting with exactly the same issue for weeks now.
Favicon not shown in FF for android 
- https, own certificate (but imported in FF trusted cert store)
- Favicon visible in Opera for android (https)
- Favicon visible if I switch to http
- Favicon visible in FF for desktop (https)
- webserver access log empty
- trace not useful

If I go to the page you mentioned 3 years ago, it works now.
Please let me knoe how you fixed it.

Thank you very much.
M.

Comment 14

[Richard Newman [:rnewman]]

(In reply to matze112 from comment #13)
> Hello Alexander,
> I'm fighting with exactly the same issue for weeks now.

If your server uses SNI, then there's little to be done.

If the issue is your self-signed certificate, then you can do one of two things.

1. Try opening the site in the Android built-in browser, and adding the certificate exception there. Then try in Firefox.

    Firefox's own certificate store doesn't apply to favicon fetches; it uses Android's.

    The web server access log will be empty because the secure handshake didn't complete, so no request was made.

2. Use Let's Encrypt instead of a self-signed certificate. I see little reason to use a self-signed cert on the public web in 2018.

Comment 15

[matze112]

Dear Richard,
thank you very much for your support and your effort.
I had already tried certificate related adjustments, but it did not work. You encouraged me to try it again and finally, after weeks of investigations and tests, it works :-).
I think the reason I did not find it the first time was, because FF for android / android has a much stricter certificate handling than FF für windows.

Here are the most important things which did the trick for me:
1. Import the CA certificate in "Trusted credentials" store - NOT in the "user credentials" store. If it is already there, delete it.
If you tab on the certificate in the "Trusted credentials" store, it must show the details of the certificate. In my case, the popup was empty first and did not show details, just two buttons (don't know why - after a second import, it worked).

2. The URL must exactly match the CN-Field in the certificate
-> FF for windows seems to be more tolerant, but android only accepts the certificate if it is 100% equal

Thank you again.
M.

Comment 16

[BMO Automation]

We have completed our launch of our new Firefox on Android. The development of the new versions use GitHub for issue tracking. If the bug report still reproduces in a current version of [Firefox on Android nightly](https://play.google.com/store/apps/details?id=org.mozilla.fenix) an issue can be reported at the [Fenix GitHub project](https://github.com/mozilla-mobile/fenix/). If you want to discuss your report please use [Mozilla's chat](https://wiki.mozilla.org/Matrix#Connect_to_Matrix) server https://chat.mozilla.org and join the [#fenix](https://chat.mozilla.org/#/room/#fenix:mozilla.org) channel.