1441132 - Insecure connection on eurostar.com due to HSTS

Status: RESOLVED DUPLICATE of bug 1436062

(Core :: Security, defect)

Description

[Andreas Tolfsen ❲:ato❳]

Attachment: Screen Shot 2018-02-26 at 12.57.05.png

This is probably more of a web compat issue than security issue, but
in the current Firefox Nightly (2018-02-26) it is not possible to
connect to https://www.eurostar.com due to an HSTS problem.

I haven’t investigated the certificate, but I’m guessing there
is a configuration problem on their side or some new, stricted rule
in Gecko that isn’t yet employed in Blink.

Not seeing a similar error in Safari.

Comment 1

[Alex Gaynor [:Alex_Gaynor]]

This is caused by the ongoing distrust of Symantec certificates -- you can see that this same issue appears if you use Chrome's Canary branch.

I'm not quite sure how we're tracking these issues, so for now I'm going to mark as a blocker on bug 1434300.

Comment 2

[Alex Gaynor [:Alex_Gaynor]]

The answer is that we're duping them over to 1436062.