1190706 - king-solarman.com is RC4 and Camellia only

Status: RESOLVED FIXED

(Web Compatibility :: Site Reports, defect)

Description

[Sergey]

User Agent: Mozilla/5.0 (X11; Linux i686; rv:41.0) Gecko/20100101 Firefox/41.0
Build ID: 20150802004005

Steps to reproduce:

Attempt to open
https://king-solarman.com/fileuploader/download/download/?d=0&file=custom%2Fupload%2FFile-1363932268.pdf
( referenced by http://king-solarman.com/talesun-tp660p-235-watt-poly.html )



Actual results:

   Secure Connection Failed
   An error occurred during a connection to king-solarman.com. Cannot
   communicate securely with peer: no common encryption
   algorithm(s). (Error code: ssl_error_no_cypher_overlap)
   [Try Again]

Since those pdfs are not available over http - it's impossible to get datasheets in firefox. Tested in Firefox DevEdition.



Expected results:

There may be a warning about insecure connection, but there must be "I know but let me in" option.


Additional information:

I tried to find what build broke it.
Last nightly build where I could get the pdf seems to be:
https://ftp.mozilla.org/pub/firefox/nightly/2015/02/2015-02-10-03-02-31-mozilla-central/firefox-38.0a1.en-US.linux-i686.tar.bz2
And the first build where there's only "Try Again" button:
https://ftp.mozilla.org/pub/firefox/nightly/2015/02/2015-02-11-03-02-28-mozilla-central/firefox-38.0a1.en-US.linux-i686.tar.bz2

Comment 1

[Loic]

The cert has expired:
https://www.ssllabs.com/ssltest/analyze.html?d=king-solarman.com
Valid until 	Fri, 23 Jan 2015 23:59:59 UTC (expired 6 months and 11 days ago) 

TE bug for me, they need to fix their cert.

Comment 2

[:Cykesiopka]

In addition, the site is RC4 and Camellia only (which is what causes the ssl_error_no_cypher_overlap error):
https://www.ssllabs.com/ssltest/analyze.html?d=king-solarman.com
> Cipher Suites
> TLS_RSA_WITH_RC4_128_SHA (0x5)
> TLS_RSA_WITH_CAMELLIA_128_CBC_SHA (0x41)
> TLS_RSA_WITH_CAMELLIA_256_CBC_SHA (0x84)

> Server hostname 	192-163-235-103.unifiedlayer.com 
Bug 1143254 and dependencies are all fixed, so this suggests that there is a way forward for this site to be fixed.

Comment 3

[:Cykesiopka]

(In reply to Sergey from comment #0)
> There may be a warning about insecure connection, but there must be "I know
> but let me in" option.

Add king-solarman.com to the security.tls.insecure_fallback_hosts pref (it takes a comma separated value).

Comment 4

[Masatoshi Kimura [:emk]]

Fixed (although the certificate is expired).