1946257 - Firefox for Android displays wrong messages on TLS error pages

Status: NEW

(Firefox for Android :: Browser Engine, defect, P3)

Description

[Dana Keeler (she/her) [:keeler]]

Steps to reproduce

1. visit https://expired.badssl.com in fenix
2. tap "advanced"

Expected behavior

Because the website's certificate has expired, the advanced text should say something about that.

Actual behavior

The advanced text explains what the problem would be if the server's certificate came from an unknown issuer, but that's not what's wrong with that certificate.

Device information

• Firefox version: 134 and 137, but honestly probably all of them
• Android device model: emulator
• Android OS version: emulator

Any additional information?

Comment 1

[John Schanck [:jschanck]]

The revoked certificate error page (https://revoked.badssl.com) is particularly confusing. The text in the advanced section says

Firefox does not trust https://revoked.badssl.com/ because its certificate issuer is unknown, the certificate is self-signed, or the server is not sending the correct intermediate certificates.

And the error page has an "Accept the risk and continue" button.

The possible reasons for the error page ("issuer is unknown", "certificate is self-signed", "[incorrect] intermediate certificates") are all overridable errors, and the button normally performs an override. But revoked certificate errors are not overridable, and clicking the override button just loops you back to the error page.

The override button is hidden for HSTS errors, but the text for HSTS errors is not appropriate for revoked certificate errors.

Comment 2

[Tom25519]

Attachment: Fennec 68.jpg

Comment 3

[Tom25519]

Fennec (Legacy Firefox for Android) shows error details like this. I think Fenix should also do this.