1693244 - Clicking "confirm security exception" triggers error, cannot fetch mail

Status: RESOLVED WORKSFORME

(Thunderbird :: Security, defect)

Description

[[:jberkus] Josh Berkus]

Attachment: Screenshot from 2021-02-16 21-11-45.png

I'm using Thunderbird 78.7.0, in a Flatpak, on Fedora Silverblue 34.

When trying to set up a secure email connection to a sever with a self-signed certificate, I cannot confirm the SSL security exception. The Confirm Security Exception dialog pops up, but clicking "Confirm Security Exception" just triggers an error in the console, and the dialog box doesn't go away, and mail is never retrieved.

I retrieved mail from this same server for years using Thunderbird 68, and never encountered this issue. However, it now happens whether I use an imported profile (which already has the security exception) or create a new profile (which has an empty cert_override file).

Note that clicking "Get Certificate" also causes the dialog to hang forever.

The error is follows. I am looking for (a) a workaround to let me retrieve my mail (maybe by disabling cert checking entirely) and (b) to solve the issue. The issue is 100% reproducable. I'm happy to try upgrading if I can get a Flatpak of a later version. Thanks!

---

Uncaught
Exception
​
columnNumber: 0
​
data: null
​
filename: "chrome://pippki/content/exceptionDialog.js"
​
lineNumber: 156
​
location: XPCWrappedNative_NoHelper { QueryInterface: QueryInterface(), filename: Getter, name: Getter, … }
​
message: "Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [nsIURI.port]"
​
name: "NS_ERROR_FAILURE"
​
result: 2147500037
​
stack: "getURI@chrome://pippki/content/exceptionDialog.js:156:7\naddException@chrome://pippki/content/exceptionDialog.js:386:13\n_fireButtonEvent@chrome://global/content/elements/dialog.js:487:19\n_doButtonCommand@chrome://global/content/elements/dialog.js:466:29\n_handleButtonCommand@chrome://global/content/elements/dialog.js:460:19\nInformUserOfCertError@chrome://messenger/content/mailWindow.js:685:10\nOnStopRunningUrl@chrome://messenger/content/mailWindowOverlay.js:2940:30\n"
​
<prototype>: ExceptionPrototype { toString: toString(), name: Getter, message: Getter, … }
exceptionDialog.js:156

Comment 1

[[:jberkus] Josh Berkus]

A big part of the problem seems to be that Thunderbird identifies the certificate as "mail.corp.redhat.com:993" when the certificate is "mail.corp.redhat.com". The certificate at "mail.corp.redhat.com" retrieves fine, and verifies fine. But the additon of ":993" to it seems to be messing everything up.

Comment 2

[[:jberkus] Josh Berkus]

comment removed, superceded

Comment 3

[[:jberkus] Josh Berkus]

FOUND workaround, so please just keep this open for solving the eventual bug.

Here's the workaround:

1. Preferences-->General-->Config Editor
2. Add new string network.security.ports.banned.override with the value of "993" (or whatever the broken port number is)
3. Preferences-->Security-->Certificates-->Manage Certificates-->Servers
4. Add Exception
5. Type https://mail.corp.redhat.com:993 into the cert field
6. Get Certificate
7. Click "confirm security exception"

I can now download mail. This also confirms that TB appending :993 to the name of the cert it's seeking is the source of the issue.

Comment 4

[[:jberkus] Josh Berkus]

For some reason, the above workaround does NOT work for port 587 and secure SMTP

Comment 5

[[:jberkus] Josh Berkus]

Closing, since I cannot verify that this is still a problem in current TB.