1817868 - inconsistent messaging around security of connections with certificate error overrides

Status: NEW

(Firefox :: Security, defect)

Description

[Daniel]

Attachment: first

User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/110.0

Steps to reproduce:

1. Went to Ubiquity Edge Router X that uses self-signed certificate

Actual results:

Firefox says connection is not secure, when opposite is correct. Probably due to accepted self-signed exception?

Expected results:

Connection is secure correctly stated even for self-signed accepted exceptions.

Comment 1

[Daniel]

Attachment: second

Comment 2

[Daniel]

Attachment: third - so is it secure or is it not as the first image says?!

This is where mostly some UI cleanup / wording change is needed.

Comment 3

[Daniel]

So this is mostly UI issue with different messages when the actual SSL is self-signed and accepted and while HTTPS connection is completely secure. Firefox states confusingly otherwise.

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::Security: PSM' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 5

[Rares Doghi, Desktop QA]

Adding the Qa not actionable tag for now. We currently dont have an Ubiquity Edge Router X router in order to reach that setup page.

Comment 6

[Daniel]

It should be possible to repeat and see this for any self-signed page. I haven't tried.

Comment 7

[Daniel]

Also, I can provide the link for testing, but not publicly.

Comment 8

[Dana Keeler (she/her) [:keeler]]

You can reproduce the issue with e.g. https://wrong.host.badssl.com/.

Comment 9

[Rares Doghi, Desktop QA]

I was able to reproduce this issue using the link from Comment 8, after accepting the risk and continued it would show Connection not secure but in the panel it shows that the connection is encrypted.
Thank you @Dana for the help.