1977400 - Instant timeout when connecting to SMTP server with self-signed certificate

Status: ASSIGNED

(MailNews Core :: Security, defect)

Description

[[:Apfelkomplott]]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0

Steps to reproduce:

1. I setup a new e-mail account with credentials to a server which uses self-signed certificates for TLS/SSL connections. IMAP settings: Port 993 using TLS. SMTP settings: Port 25 using STARTTLS.
2. Optional: I imported the root certificate of the self-signed server certificate as Certificate Authority (CA)

Actual results:

• Fetching emails using IMAP works after I accept the self-signed certificate in the dialog that pops up
• Sending an email fails immediately with a timeout. No dialog is shown where I could accept the certificate.

Expected results:

Sending emails using a server with self-signed certificates should work.

Comment 1

[[:Apfelkomplott]]

BTW: The problem occured on a Windows 11 machine.

Comment 2

[Nic Jones]

We had this issue after the update to 141.0esr. Although in our case the issue is a certificate with an invalid domain, rather than a self-signed certificate, it exhibited the same issue.

We fixed it by first setting the connection security to None, and the authentication to "password, transmitted insecurely", sending an email, then changing the connection security back to STARTTLS.

Comment 3

[Kai Engert [:KaiE:]]

Nic Jones:

I can reproduce the bug in 141 in later. It seems to be related to STARTTLS.

Comment 4

[Kai Engert [:KaiE:]]

Apfelkomplott:

Can you please say in version you experience this bug?

I don't see a bug in 140. You initially reported this bug against version 140.

I see the bug in 141 and later.

Comment 5

[Kai Engert [:KaiE:]]

Not sure what happened when I wrote comment 4.

Today I can reproduce with 140, too.

Comment 6

[Kai Engert [:KaiE:]]

Attachment: Bug 1977400 - Offer to set a certificate override on PKIX certificate validation failures. r=mkmelin

Comment 7

[Kai Engert [:KaiE:]]

Could you please help to test a potential fix for this bug?

Please download and extract the following build, and run it directly from the extracted directory.
It is a build based on 140.x, so it should work fine with your existing profile from the 140.x version.
(If necessary, you can pass the -P parameter to Thunderbird to get a profile selection prompt.)

Linux 64bit:
https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/QWctbexDRU2eMWCWEfZx3A/runs/0/artifacts/public/build/target.tar.xz

Windows 64bit:
https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/X1Yw7SySSvenoU7teEbm7A/runs/0/artifacts/public/build/target.zip

Let me know if you need another platform for testing.

(The test build contains a view additional fixes, test build is here:
https://treeherder.mozilla.org/jobs?repo=try-comm-central&revision=24c779a2db5ec40dd1b5676f48944aceabd973fc )

Comment 8

[Kai Engert [:KaiE:]]

Does anyone prefer to test the fix with another version, 141, 142, 143 ?

Comment 9

[raal]

(In reply to Kai Engert [:KaiE:] from comment #7)

Could you please help to test a potential fix for this bug?

Please download and extract the following build, and run it directly from the extracted directory.
It is a build based on 140.x, so it should work fine with your existing profile from the 140.x version.
(If necessary, you can pass the -P parameter to Thunderbird to get a profile selection prompt.)

Linux 64bit:
https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/QWctbexDRU2eMWCWEfZx3A/runs/0/artifacts/public/build/target.tar.xz

I can confirm it works now! After sending an e-mail the security exceptions dialog appears. Thank you for the fix.