31737 - Unnecessary "No Acceptable Identification" dialog when client certs optional

Status: VERIFIED FIXED

(Core :: Security: PSM, enhancement, P3)

Description

[John G. Myers]

Connecting to an SSL server where user certs are requested but not required when 
the user has no client certs installed, PSM puts up a modal dialog box "No 
Acceptable Identification".

This dialog box annoys the user for no purpose and discourages sites from 
configuring their servers to accept client certs, since configuring their 
servers that way will annoy their large installed base of non-cert-holding 
users.

If the server sends a fatal alert indicating a certificate is required, then 
such a dialog box would be useful.  Otherwise, the server is perfectly capable 
of giving the user a reasonable error message, if such is warranted.

Comment 1

[John Unruh]

RFE

Comment 2

[John G. Myers]

Attachment: Proposed fix

Comment 3

[Bob Lord]

Adding the usual suspects to the cc list.

Comment 4

[Javier Delgadillo]

The patch is good and should go in once the PSM 1.2 tree has been tagged and 
shipped.  Hopefully within the next week.

Comment 5

[Bob Lord]

Approved once PSM 1.2 ships.

Comment 6

[Javier Delgadillo]

Re-assigning to [e-mail] since he coded the fix and will ultimately 
check it in.

Comment 7

[John G. Myers]

Fix checked in.

Comment 8

[John Unruh]

Is there a testcase so that I can verify this?

Comment 9

[John G. Myers]

Adding testcase

Comment 10

[Nelson Bolyard (seldom reads bugmail)]

Removed self from cc list

Comment 11

[John Unruh]

Reopening. There is still a "No Acceptable Identification" dialog on Mac, Linux 
and Win98 when visiting https://we-gotmail.red.iplanet.com

Comment 12

[John G. Myers]

Did you test with a post-1.2 tip PSM build?

Comment 13

[John Unruh]

Re-marking fixed. Will verify when I get a new build of PSM.

Comment 14

[John Unruh]

Verified fixed on 8/28 linux with the 8/28 build of psm.