334658 - Improve user feedback on broken OCSP responders

Status: RESOLVED WORKSFORME

(Core Graveyard :: Security: UI, defect, P1)

Description

[Kai Engert [:KaiE:]]

As of today, when OCSP is enabled, a Mozilla application tries to contact a OCSP responder, better feedback should be given to the user.

As of today, we display a modal dialog saying:
"Error trying to validate certificate from $siteURL using OCSP - server error."

A better way could be to show a new error page with a more detailed explanation, like:
"$applicationName attempted to verify the validity of $siteURL by contacting $OCSP_URL (using the OCSP protocol).  However, $OCSP_URL did not respond to this validity request.  Please contact the administrator of $siteURL with this information." 

The error page should make it clear, it's NOT our Mozilla application that has a problem, but the web site.

Comment 1

[Kai Engert [:KaiE:]]

However, this error message is appropriate only when doing SSL in the context of web browsing.

When doing SSL in other contexts, where no content view is in use (e.g. talking to a mail server, when managing certificates, ...), the modal dialog seems to be the only way to communicate the error to the user...?

Comment 2

[Bob Lord]

Attachment: screenshot of ocsp error

Error message I get routinely (every hour or more) when OCSP is turned on, and I'm using GMail.

Comment 3

[Bob Lord]

I get the above error on a regular basis.  

The error is frustrating, but the larger issue is that when this error appears, Firefox consumes 100% of my CPU until I dismiss it!  Even actions like trying to take a screenshot take 30+ seconds.  Then my extra fans kick in to cool the CPU.  When I leave GMail on overnight, my machine overheats.

The CPU consumption is a serious bug.

Comment 4

[Kai Engert [:KaiE:]]

Do you get this frequently on Linux, too?

I saw this error message when the verisign OCSP responder was down. But after they had fixed the issue weeks ago, I never ever again saw the error message.

In order to help reproduce, I created a test bugzilla account and I'm now watching my primary user account, so I will get mail regularly. Please feel free to pass address [e-mail] to spammers :-)

Comment 5

[Kai Engert [:KaiE:]]

We have two tasks here:

- improve the error message slightly, as it has been prposed in comment 0

We need to do it as a modal dialog, because this message is not limited to web pages

- find out what triggers the problem reported in comment 3

I have never been able to reproduce, even when running Gmail over https for many hours, OCSP turned on, using a proxy.

I will now try harder to reproduce on windows, set up a script that will send mail to my gmail account every couple of seconds.

Comment 6

[Kai Engert [:KaiE:]]

The problem reported in comment 3 will be tracked in bug 336944.

Comment 7

[Kai Engert [:KaiE:]]

reassign bug owner.
mass-update-kaie-20120918

Comment 8

[Dana Keeler (she/her) [:keeler]]

The about:neterror page is used for this now.