1606098 - Secure connection failed when accessing Outlook app in Office 365

Status: RESOLVED WORKSFORME

(Web Compatibility :: Site Reports, defect)

Description

[Simona Badau, Desktop QA]

Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:73.0) Gecko/20100101 Firefox/73.0
Build ID: 20191227094418

Affected versions:

• Nightly 73.0a1
• Firefox 72 beta 11
• Firefox 71
• Firefox 68.3.0esr

Affected platforms:

• Windows 10
• Mac OS X 10.15
  -Ubuntu 18.04

Steps to reproduce:

1. Log in into your Office365 account
2. Click on the App launcher located in the upper left side of the page
3. Click on the Outlook app

Actual results:
Outlook seems to be loading at the beginning but navigation is not allowed - the "Secure Connection Failed" error is reached.

Expected results:
Navigation to Outlook is allowed.

Comment 1

[Ryan VanderMeulen [:RyanVM]]

Can you share the error code given by the "Secure Connection Failed" page?

Comment 2

[Simona Badau, Desktop QA]

(In reply to Ryan VanderMeulen [:RyanVM] from comment #1)

Can you share the error code given by the "Secure Connection Failed" page?

Hi Ryan,
This is what I get when trying yo log in:

"Secure Connection Failed

An error occurred during a connection to outlook-sdf.office.com.

The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
Please contact the website owners to inform them of this problem."

Comment 3

[Ryan VanderMeulen [:RyanVM]]

This appears to be working for me :\

Comment 4

[Simona Badau, Desktop QA]

Attachment: Office365Issue.mp4

Some additional information: - please note that I can't reproduce this issue on Chrome 79.0.3945.88 (using the same Office 365 account) and neither on my personal Microsoft Account.

Unfortunately, I'm not seeing any other error code, and when I click on the "Learn more" link, I'm redirected to:
https://support.mozilla.org/en-US/kb/secure-connection-failed-firefox-did-not-connect?as=u&utm_source=inproduct

Comment 5

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Can you attach a packet trace of the TLS handshake? (using e.g. wireshark)

Comment 6

[Simona Badau, Desktop QA]

Attachment: TLSpack.pcapng

(In reply to Dana Keeler (she/her) (use needinfo) (:keeler for reviews) from comment #5)

Can you attach a packet trace of the TLS handshake? (using e.g. wireshark)

Please let me know if this is what you need.

Comment 7

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

(In reply to Simona Badau from comment #6)

Created attachment 9118763 [details]
TLSpack.pcapng

(In reply to Dana Keeler (she/her) (use needinfo) (:keeler for reviews) from comment #5)

Can you attach a packet trace of the TLS handshake? (using e.g. wireshark)

Please let me know if this is what you need.

That file appears not to contain any packets. Make sure you're capturing on the interface your traffic is going through.

Comment 8

[Simona Badau, Desktop QA]

Attachment: TLSpacket2.pcapng

(In reply to Dana Keeler (she/her) (use needinfo) (:keeler for reviews) from comment #5)

That file appears not to contain any packets. Make sure you're capturing on the interface your traffic is going through.

Added it again. Please let le know if it's ok this time.

Comment 9

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Thanks! There doesn't seem to be a problem with the handshake, so maybe this is a network issue?

Comment 10

[Andy Grover [:grover]]

Michal wdyt?

Comment 11

[Michal Novotny [:michal]]

Could you please provide HTTP log? See https://developer.mozilla.org/en-US/docs/Mozilla/Debugging/HTTP_logging

Comment 12

[Simona Badau, Desktop QA]

Attachment: log.zip

(In reply to Michal Novotny [:michal] from comment #11)

Could you please provide HTTP log? See https://developer.mozilla.org/en-US/docs/Mozilla/Debugging/HTTP_logging

Added the HTTP logs, please let me know if anything else is needed.

Comment 13

[Michal Novotny [:michal]]

Thanks, I'm looking into the log now. In the meantime, could you please check if it behaves the same when HTTP/2 is disabled?

Comment 14

[Michal Novotny [:michal]]

I see in the log that the server starts sending the data and after 49520 bytes it resets the HTTP/2 stream with reason 13:

2020-01-08 13:57:06.241000 UTC - [Parent 6464: Socket Thread]: E/nsSocketTransport nsSocketTransport::SendStatus [this=0000016ABD92B000 status=804b0006]
2020-01-08 13:57:06.241000 UTC - [Parent 6464: Socket Thread]: V/nsHttp Http2Session::LogIO 0000016ABCC62800 stream=0000000000000000 id=0x0 [Reading Control Frame]
2020-01-08 13:57:06.241000 UTC - [Parent 6464: Socket Thread]: V/nsHttp 00000000: 00 00 00 0D
2020-01-08 13:57:06.241000 UTC - [Parent 6464: Socket Thread]: I/nsHttp Http2Session::RecvRstStream 0000016ABCC62800 RST_STREAM Reason Code 13 ID 11

According to https://http2.github.io/http2-spec/#ErrorCodes error code 13 means:
HTTP_1_1_REQUIRED (0xd): The endpoint requires that HTTP/1.1 be used instead of HTTP/2.

It looks like some weird server side bug, but we should probably handle this error code in a better way.

Comment 15

[Simona Badau, Desktop QA]

(In reply to Michal Novotny [:michal] from comment #13)

Thanks, I'm looking into the log now. In the meantime, could you please check if it behaves the same when HTTP/2 is disabled?

With disabled HTTP/2 protocol, I get the same behavior - I'm still not able to access Outlook.

Comment 16

[Michal Novotny [:michal]]

(In reply to Simona Badau from comment #15)

(In reply to Michal Novotny [:michal] from comment #13)

Thanks, I'm looking into the log now. In the meantime, could you please check if it behaves the same when HTTP/2 is disabled?

With disabled HTTP/2 protocol, I get the same behavior - I'm still not able to access Outlook.

Could you please provide also log when HTTP/2 is disabled?

Comment 17

[Simona Badau, Desktop QA]

Attachment: logHTTP2Disabled.zip

(In reply to Michal Novotny [:michal] from comment #13)
Could you please provide also log when HTTP/2 is disabled?

Yes, sure. Please let me know if there is anything else I can do.

Comment 18

[Michal Novotny [:michal]]

How did you disable HTTP/2? The log shows that it is still used:

2020-01-09 09:18:20.494000 UTC - [Parent 11676: Socket Thread]: I/nsHttp http response [
HTTP/2 200 OK

Comment 19

[Simona Badau, Desktop QA]

Attachment: log2.zip

(In reply to Michal Novotny [:michal] from comment #18)

How did you disable HTTP/2? The log shows that it is still used:

2020-01-09 09:18:20.494000 UTC - [Parent 11676: Socket Thread]: I/nsHttp http response [
HTTP/2 200 OK

I disabled HTTP/2 from the Windows Registry Editor - apparently, not the method you were referring to. So, I tried again, this time by setting the preference "network.http.spdy.enabled.http2" to false. This did the trick, and I am now able to access the Outlook app from Office 365.

Comment 20

[Honza Bambas (:mayhemer)]

Michal, is this the bug we were talking about at the last Necko meeting being classified as a server issue? If not, will you find time to finish the diagnoses here? Thanks.

Comment 21

[Michal Novotny [:michal]]

Yes, this is the bug we discussed and it's a server side issue.

Comment 22

[Ryan VanderMeulen [:RyanVM]]

Why is this only affecting Firefox in that case? Why are we failing harder here?

Comment 23

[Michal Novotny [:michal]]

Dragana mentioned that there is a bug about the same issue and it was reproducible on Chrome too. Dragana, do you remember the bug number?

Comment 24

[Dragana Damjanovic [:dragana]]

It is bug 1604687

Comment 25

[Dragana Damjanovic [:dragana]]

Let's try to find out which server is causing this and fix it on the server side.
I am not sure I have the right component.

Comment 26

[Dennis Schubert [:denschub]]

This does not appear like something we could fix by shipping an intervention. Tagging as contactready so it's on the pile of Outreach-ToDo.

Comment 27

[Simona Badau, Desktop QA]

I can no longer reproduce this issue with the default settings, verified on Firefox 73.0.1, Firefox 74 beta 7 and Nightly 75.0a1.