399905 - Bad cert domain error when clicking a link on fedex.com

Status: RESOLVED WORKSFORME

Description

[Marcia Knous [:marcia - use ni]]

Seen while testing Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.9a9pre) Gecko/2007101504 Minefield/3.0a9pre.

An error occurred during a connection to fedex.com:443 because it uses an invalid security certificate. The certificate is not valid for domain name fedex.com. (ssl_error_bad_cert_domain). 

STR:

1. Using the latest nightly, go to fedex.com
2. Without signing in, click on "prepare an international shipment."
3. Receive the error message. Click "Try Again" and you are in a loop.

On Safari if I follow the same steps, it just returns me to the login screen.

Comment 1

[Carsten Book [:Tomcat]]

maybe related to bug 399324

Comment 3

[Daniel Veditz [:dveditz]]

In ff2 you get a bad cert error because the cert is for "www.fedex.com" and the URL loaded is fedex.com, this is really a site issue

Interestingly if you disable javascript you get a different, plainer, page, and if you select "prepare an internation shipment" on that page you get a link to the correct "https://www.fedex.com" site and no cert error.

This is technically tech evangelism -- the site is wrong. They could either use an absolute URI for the secure sites rather than building them based on the current site, or they could simply redirect all "fedex.com" visitors to the "real" site www.fedex.com on the initial page view.

Unfortunately this is the sort of issue that's going to come up a lot due to the new SSL error pages. I believe the "improve the text" bug will include suggestions such as "try adding "www." to the URI.

IE7 has an equivalent SSL error page (with a click-through link) but also has a "more information" link that suggests adding "www." to the front of the URI.

Opera and Safari work correctly, and the reason is very odd: The page source itself actually does contain the correct working link, but in the case of IE and Firefox the page runs http://images.fedex.com/templates/components/javascript/host_substitution_script.js to rewrite all the links into the broken fedex.com form!

Definitely tech-evangelism, the site is trying to be too smart for its own good.

Comment 4

[Daniel Veditz [:dveditz]]

In this case, because the site has perfectly good working URLs that their own code messes up, I think we should reopen as tech evangelism rather than duping to the general (www.)foo.com cert issue.

Comment 5

[Adam Stevenson [:adamopenweb]]

Site has been updated, this issue no longer exists.