1683382 - Kaspersky interferes with HTTPS-only mode override for bad certs

Status: NEW

(Core :: DOM: Security, task, P3)

Description

[Daniel Veditz [:dveditz]]

Attachment: Capture d%u2019écran (35).png

If you use Kaspersky in monitoring mode, it interferes with HTTPS-only mode's ability to allow overrides for sites that don't have an HTTPS version, but are on shared hosting that does have a mis-matched certificate. Instead of our HTTPS-only "Secure Site Not Available" interstitial that allows an override, Kaspersky tells the user about the bad cert and does not allow an override.

If users know about it they can use the lock-icon doorhanger to turn off HTTPS-only mode for that site, but our nice helpful UI is zapped. See customer screenshot.

Comment 1

[Christoph Kerschbaumer [:ckerschb]]

Potentially we could reach out to Kaspersky, because I don't know of a fix in the browser. The workaround is to temporarily allow http connections I guess.