425136 - Need UI to handle web server certificate problems

Status: RESOLVED DUPLICATE of bug 545556

(Firefox :: Sync, defect)

Description

[Igor Velkov]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b5pre) Gecko/2008032505 Minefield/3.0b5pre
Build Identifier: 

Need some user interface to warn about SSL problems and handle some of it.
Now there no mechanism to know about bad or changed certificate, no possibility to add to exclusion list self-signed certificate of server.

Reproducible: Always

Comment 1

[Dan Mills [:thunder]]

Targeting for 0.2 (P2).
Unclear what the desired UI for this is.

Comment 2

[Chris Beard]

not going to make 0.2, reassigning to 0.3.  we should document the workaround and include in a release note.

Comment 3

[Jürgen Kreileder]

I'm not sure if that really should be implemented.

The recommended way to handle this is to create your own CA and sign your certificate with it.  Then important your CA into Firefox (Preferences -> Advanced -> Encryption -> View Certificates -> Authorities -> Import; select the crt file and check "This certificate can identify web sites").  After that Firefox will gladly accept your certificate.

Comment 4

[Dan Mills [:thunder]]

Currently Weave will fail silently if you use your own server with a self-signed cert.  The solutions (either adding an exception for the cert, or adding a CA to Firefox as comment #3 suggests) work fine, but they need to be suggested somewhere.

I would be OK with a minimal solution for this bug (just warning of the problem with some explanation of how to solve it).

Comment 5

[Jesper Hansen]

If weave is using xmlhttprequests then Fx3 provides a method to ignore SSL certificate errors. 
Fx2 does not, but handles it by some other method.
Wonder if Fx2 would even be target app. when Weave goes 1.0

Comment 6

[Dan Mills [:thunder]]

These bugs need to be triaged, removing 0.3 milestone setting.

Comment 7

[Mike Connor [:mconnor]]

We are not going to ignore SSL certificate errors silently.  I think that I'm okay with documenting a workaround for people wanting to use a self-signed cert:

Advanced->Encryption->View Certificates->Add Exception

Strongly recommend WONTFIX here, building UI for this case feels like it's a lot of work for a corner case.

Comment 8

[Igor Velkov]

Then, at least, add descriptive error message into the log? Makes possible to google wiki page with solution (open url with broswer and add exclusion here will be much more suitable).

Comment 9

[Murz]

In Weave 0.7 & Firefox 3.5 every time after new install I have the problem with certificates.
When syncing weave founds very old certificates (self-signed) that I didn't use anymore, but they show the warning (screenshot http://imagebin.ca/view/FOVDcpvO.html) for each certificate more than one times (the window have only Cancel button, I press it and firefox shows me this message again, very often - 2-50 time per session!!)
And this messages repeats again each session, while I open the site with certificate and correctly confirm firefox security exception.

And, I think, we need a tool to clear old certificates from Weave user database.

Comment 10

[Mike Connor [:mconnor]]

Duping forward to Bug 545556, since there's a bunch of different things, and I think that bug sums up the path we want to take here.

Comment 11

[Richard Newman [:rnewman]]

Removing priority from a duped bug.