1320822 - 400 Bad Request error when trying to log into Air Mozilla using Auth0 on my Samsung TV browser

Status: VERIFIED FIXED

(Infrastructure & Operations :: SSO: Issues, task)

Description

[Chris Peterson [:cpeterson]]

I am unable to log into Air Mozilla using Auth0 with my Samsung TV browser.

STR:
1. Load https://air.mozilla.org/authentication/signin/
2. Click the page's "Sign In" button.
3. Click the Auth0 login widget's "Login with Google" or "Login with GitHub" button.

RESULT:
The browser is redirected to auth.mozilla.auth0.com and shows the following error message: "400 Bad Request. The SSL certificate error. nginx"

I loaded a different website that uses a Let's Encrypt cert and it didn't show any cert errors, so this error does not appear to be that the Let's Encrypt root cert is untrusted.

My Samsung TV and Windows desktop have the same public IP address (67.188.162.191) so there does not appear to be a Samsung proxy server between my TV browser and the web.

My TV browser's User-Agent string is:

Mozilla/5.0 (SMART-TV; Linux; Tizen 2.4.0) AppleWebKit/538.1 (KHTML, like Gecko) SamsungBrowser/1.1 TV Safari/538.1

Comment 1

[Guillaume Destuynder [:kang] [this account is no longer active]]

I've opened a ticket on auth0 side to look at the nginx 400 error on auth.mozilla.auth0.com as well:
https://support.auth0.com/tickets/17696 (this is a private issue, I'm putting this here for reference)

Comment 2

[Guillaume Destuynder [:kang] [this account is no longer active]]

I believe this may be fixed. The server was incorrectly sending a client certificate request, that is handled differently by different clients. Normally, reply is optional, but not necessarily.

The client response in this case also caused a 400 error on the nginx side, as while it requested a certificate it did not expect one back.

Can you re-test and confirm ?
(also pinged on IRC)

Comment 3

[Guillaume Destuynder [:kang] [this account is no longer active]]

From IRC: cpeterson | \o/ it worked!

Closing on your behalf. It was fixed by disabling the option server-side.

Thanks!

Comment 4

[Chris Peterson [:cpeterson]]

Yes. I can successfully log in now.