1719309 - HTTPS-First test for bad certifactes

Status: RESOLVED FIXED

(Core :: DOM: Security, task, P2)

Description

[Tomer Yavor]

When https-first opens a site with bad certificate, we might want to skip to show a warning page.
Instead https-first could downgrade the request to http

Comment 1

[Tomer Yavor]

Currently https-first acts like that:

1. Assume we have a website example.com that supports both http and https.
2. If the initial request is http://example.com https-first is upgrading it, receiving an error and downgrades to http
3. If the initial request is https://example.com : Since it is an https request which wasn't upgraded by https-first, https-first doesn't downgrade it
4. Warning page gets displayed.

Probably we would need https-first to interfer https requests, to skip every warning page. But if https-first is interfering, it would have max. two options. One is to accept the bad cert, so we don't have actually an https connection but at top level it would still look like one (? not sure if it is still kind of an https connection... ).
The other option would be to downgrade to http but probably in most cases the http site redirects to the https site, at least that would be reasonable for a website that thinks it supports https.

Comment 2

[Tomer Yavor]

So a simple downgrade won't work, in most cases.

Comment 3

[Christoph Kerschbaumer [:ckerschb]]

Downgrading to http when encountering a bad certificate error seems correct to us.

Comment 4

[Tomer Yavor]

Attachment: Bug 1719309 - HTTPS-First test for bad certifactes. r=ckerschb

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/e207e7944cd2
HTTPS-First test for bad certifactes. r=ckerschb

Comment 6

[Natalia Csoregi [:nataliaCs]]

https://hg.mozilla.org/mozilla-central/rev/e207e7944cd2