302176 - it returns a error that the connection has been terminated. IE works great without problems.

Status: RESOLVED INVALID

(Core :: Security, defect)

Description

[Bogdan]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; ro-RO; rv:1.7.10) Gecko/20050717 Firefox/1.0.6
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; ro-RO; rv:1.7.10) Gecko/20050717 Firefox/1.0.6

It's happening only on this site (from what I've browsed till now) and it just
don't display the secured pages. Some of the people said that the certificate is
expired but it's okay, is a valid SSL certificate. The IE doesn't seem to have
any problems with this url. I've heared (didn't tested) that Mozilla 1.0 for
Linux seems to display the site correctly without any problems. THIS IS NOT A
PROXY SETTING PROBLEM, A FIREWALL OR ANY KIND OF THIS STUFF. IT'S JUST A "RANDOM
FEATURE" OF YOUR BROWSER.

Reproducible: Always

Steps to Reproduce:
1. Just click paste that link into Mozilla (Firefox or Netscape)
2.
3.

Actual Results:  
Received an errror "Connection was terminated. Some data may have been transferred".

Expected Results:  
Validate the SSL certificate and display the page correctly.

Comment 1

[Daniel Veditz [:dveditz]]

clearing confidential flag to get some more eyes on it.

Opera does not connect either (even when identifying as IE). We'll need to
investigate whether
 - the site uses a MS-only extension
 - has a flawed cert that IE doesn't catch
 - server explicitly rejects non-IE browsers

Comment 2

[Jaime Mitchell (use [e-mail] for email)]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b4) Gecko/20050726
Firefox/1.0+ ID:2005072606

WFM, I add items to the cart etc.. I can access some of the secure pages. 

Was there a particular page that was causing a problem?

Comment 3

[Bogdan]

Hello,

I'm sorry for this alert, it's not a bug. This was a problem from the setting 
done on the hosting company's servers. Sorry again for this false alert. 
That's why Mitchell didn't saw the problem, it has been resolved already.

I will put here some more information, in case someone else is reporting the 
same issue:

 Please check the following configuration on your webserver:
 The SSLProtocol directive is set to 'SSLProtocol all -SSLv3' which allows a 
client to connect with either SSLv2 or TLSv1 but not SSLv3 which is the 
standard SSL Protocol and also allows for the chaining of Certificates.
 In order for the Intermediate Certificate to be recognised you will need to 
change the SSLProtocol directive to ALL: 'SSLProtocol ALL'
 You can also set the SSLCipherSuite to include SSLV3 - 
Example "SSLCipherSuite ALL:!
ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv3:+EXP:+SSLv2" NOTE: SSLV3 needs to appear 
1st in this string.
 For an [online] example of how a httpd.conf should look like for SSL, go to 
the following url,
 <http://www.apache-ssl.org/httpd.conf.example>

Comment 4

[Jaime Mitchell (use [e-mail] for email)]

Resolve Invalid as per comment 3 - not a firefox bug.