297866 - always a red x on lock icon when visiting secured https pages

Status: RESOLVED WORKSFORME

(Firefox :: Security, defect)

Description

[JS]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4

Every time I access a secured page (https), the lock icon shows but it has a red
X on it and the location bar turns to red like if it was not safe. The problem
began with Firefox 1.0.4 I think because I didn't have that kind of problem before.

Reproducible: Always

Steps to Reproduce:
1. Visit a secured webpage (ex:
https://bugzilla.mozilla.org/enter_bug.cgi?product=Firefox&format=guided)
2.Look at the bottom of the browser and look at the location bar
3.

Actual Results:  
X on lock icon

Expected Results:  
closed lock icon with no X

Comment 1

[Aaron Slunt]

WFM Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050615
Firefox/1.0+ ID:2005061516

Comment 2

[Mike Connor [:mconnor]]

red implies an extension or another theme, since we only do yellow or the default...

Comment 3

[Daniel Veditz [:dveditz]]

What theme are you using? What themes and extensions do you have installed? Do
you get the same problem if you run in "safe mode"? (installed shortcut, or from
commandline "firefox -safe-mode")

Comment 4

[Hanspeter Niederstrasser]

Using the default theme on 1.0.4, visiting
<https://preferences.sbcmail.com/sbc/pc.asp?emailaddr=[e-mail]> I get a
lock with a diagonal through it (still yellow background).  The security info
tab has the normal text about being secure, verified, trusted, etc.

I've seen this recently on Gmail as well.  Gmail and sbcmail.com both use
AES-256.  Gmail works ok now, but the sbcmail.com page still has the broken lock.

Mozilla 1.7.8 (Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.8)
Gecko/20050511) also shows the slashed icon in the above URL using Classic and
Modern.

Comment 5

[JS]

(In reply to comment #3)
> What theme are you using? What themes and extensions do you have installed? Do
> you get the same problem if you run in "safe mode"? (installed shortcut, or from
> commandline "firefox -safe-mode")

OK I used to have a downloaded theme but now I changed to the default theme and
I see the lock with a diagonal through it just like hanspeter mentionned. The
security info seems normal but I'm not sure it's safe!

Comment 6

[JS]

And yes I get the same result in safe mode...

Comment 7

[Frank Wein [:mcsmurf]]

The problem from Comment 4 is invalid because the site has unsecure content on
it (the images and the swf from http://anon.doubleclick.speedera.net).

Comment 8

[Hanspeter Niederstrasser]

Related:

Bug 135007 - Transfer mode of images should be relevant for shown lock icon state
Bug 130949 - Lock icon issue tracking bug
Bug 271051 - Address bar should use another color when lock icon is broken
(https page with mixed content)

I could not find an exact dupe for this bug.  If this is not a dupe, then
perhaps a site with mixed http/https content should say so in the Page Info
Security tab.  This bug can either be morphed into that or a new bug can be opened.

Comment 9

[Jesse Ruderman]

Hanspeter: bug 263182 covers that issue (Page Info (Security tab) doesn't
explain mixed secure/insecure).

JS:  with the default theme, on what sites do you see a crossed-out lock icon?

Comment 10

[Jesse Ruderman]

JS: also, what extensions are you using?  Does the lock become normal if you
disable your extensions by running Firefox in safe mode or disabling them manually?

Comment 11

[Jesse Ruderman]

I haven't seen a response from the reporter, so marking WFM.