354393 - key update url should point to sb-ssl.google.com

Status: VERIFIED FIXED

(Toolkit :: Safe Browsing, defect)

Description

[Tony Chang (Google)]

We want to separate the expensive ssl getkey request from the rest of the traffic generated by the phishing service (it makes it easier to load balance) before the final release.  This is a single URL change in the default prefs file.

Unfortunately, I can't submit the change now because we don't have the domain set up yet.  We'll try to get it live before the RC2 freeze.

Comment 1

[Tony Chang (Google)]

Attachment: www.google.com -> sb-ssl.google.com

Comment 2

[Mike Schroepfer]

Tony,

We can't ship FF2RC2 with a broken anti-phishing.  So once you've confirmed the domain is ready - we'll take this patch.  If you can't have it ready in time we'll  have to ship as is.

Comment 3

[Mike Schroepfer]

Note - if we miss the 2.0 window we can make this change with 2.0.0.1.  Also - with other URLs we've tended to put re-directs in place prior to the servers being ready.  So if that is an option for you (redirect sb-ssl.google->www.google until sb-ssl is ready).

Comment 4

[Tony Chang (Google)]

(In reply to comment #3)
> Note - if we miss the 2.0 window we can make this change with 2.0.0.1.  Also -
> with other URLs we've tended to put re-directs in place prior to the servers
> being ready.  So if that is an option for you (redirect
> sb-ssl.google->www.google until sb-ssl is ready).

Yup, that's what we're trying to do.  I'll re-nominate once it's up and running.

Comment 5

[Tony Chang (Google)]

Comment on attachment 240227 [details] [diff] [review]
www.google.com -> sb-ssl.google.com

This is live now.

Comment 6

[Mike Beltzner [:beltzner, not reading bugmail]]

Comment on attachment 240227 [details] [diff] [review]
www.google.com -> sb-ssl.google.com

r+a=beltzner on behalf of drivers, please get this landed in time to get wide testing in tomorrow's nightly build so we can have some in-field testing before the RC2 cutoff.

Comment 7

[Mike Beltzner [:beltzner, not reading bugmail]]

21:31 < tony> gar, ssl cert error. I thought we had fixed that.  Holding off until I figure out what's going on.

Consider the a+ to be conditional on "figuring out what's going on" ;) Glad to see that you're testing it!

Comment 8

[Tony Chang (Google)]

The ssl cert change was pushed early this afternoon.  However, there may be some issues with DNS caches causing some people to see a cert error until 24 hours after the change was pushed.

Going to go ahead and submit now so people can test, but with a caveat that there may be cert warnings.  (This is actually my fault for not having fixed bug 345124.)

Comment 9

[Tony Chang (Google)]

on branch and trunk

Checking in firefox.js;
/cvsroot/mozilla/browser/app/profile/firefox.js,v  <--  firefox.js
new revision: 1.71.2.76; previous revision: 1.71.2.75

Checking in firefox.js;
/cvsroot/mozilla/browser/app/profile/firefox.js,v  <--  firefox.js
new revision: 1.163; previous revision: 1.162

Comment 10

[Tony Chang (Google)]

From a colo in Florida:
 ~ >openssl s_client -connect sb-ssl.google.com:443
...a bunch of spew...
subject=/C=US/ST=California/L=Mountain View/O=Google Inc/OU=Terms of use at www.verisign.com/rpa (c)06/CN=*.google.com        
issuer=/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)05/CN=VeriSign Class 3 Secure Server CA

The key part being the *.google.com.

Comment 11

[Jackie Liu]

Verified fix in "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1) Gecko/20061003 BonEcho/2.0"

Comment 12

[Tracy Walker [:tracy]]

verified 1.8.1 per comment 11