190739 - "no common encryption algorithms" at amazon

Status: VERIFIED WORKSFORME

(Core Graveyard :: Security: UI, defect)

Description

[Judson Valeski]

using mozilla winxp trunk build 2003012508.

I was shopping at amazon and when I proceeded to checkout I got a strange dialog
saying something about "Mozilla cannot proceed because amazon and mozilla do not
share a common encryption algorithm." I don't recall the exact wording.

Also, when I got the dialog I noticed that the URL in the URL bar was https,
but, the security icon lock was not locked (note: it wasn't the broken red either).

I hit ok in the dialog, clicked the checkout button again, and everything went
through fine (no dialog the second time).

Comment 1

[Matthias Versen [:Matti]]

no security hole -> PSM

Comment 2

[Matthias Versen [:Matti]]

bugzilla is buggy

Comment 3

[Kai Engert [:KaiE:]]

This sounds like it could be related to the recent addition of more ciphers.
There is one regression known with DHE ciphers. Possibly, Amazon uses multiple
different web servers and on first attempt, a SSL connection using DHE was
attempted, but failed. Maybe on your second attempt, you connected to a
different server which did not speak DHE, and all went fine.

We have a separate bug about problems with DHE, maybe we should file this as
duplicate.

We are also planning to land a patch to disable DHE until the problems are fixed
(bug 190640).

Comment 4

[John Unruh]

Marking works for me. This should work now that bug 190640 has been fixed.

Comment 5

[John Unruh]

Verified WFM.