434114 - SSL Warning when using a download from Mozilla HTTPS Sites

Status: VERIFIED FIXED

(www.mozilla.org :: General, defect)

Description

[Carsten Book [:Tomcat]]

When you download something from https://www.mozilla.com/en-US/firefox/all.html or from one of you all-beta - all-rc pages you run into a pop-up with a SSL Error:

ostats.mozilla.com:443 uses an invalid security certificate.

The certificate is only valid for <a id="cert_domain_link" title="*.112.2o7.net">*.112.2o7.net</a>

(Error code: ssl_error_bad_cert_domain)

After this, the download starts, but its a bad user experience and maybe something we should fix for the Firefox 3 Final Launch

Comment 1

[Wil Clouser [:clouserw]]

Also happens on https://www.mozilla.com/

Comment 2

[Paul Kim]

this is an omniture domain - *.112.2o7.net 

ken: i thought we had required omniture to make explicit their domains, including
for security certs?

      

Comment 3

[ken kovash]

good find.  *.112.2o7.net shouldn't be in use (ostats.mozilla.com should).  copying Justin.  Jeremy -- do we need to contact Caleb at Omniture?

Comment 4

[Jeremy Orem [:oremj]]

ostats.mozilla.com is in use, but that domain is using a 112.2o7.net certificate.  I already contacted Caleb and will have him swap that out for a valid cert ASAP (probably next week).

Comment 5

[Jeremy Orem [:oremj]]

Fixed in http://viewvc.svn.mozilla.org/vc?view=rev&revision=13562

Comment 6

[Reed Loden [:reed]]

http://www.mozilla.com/en-US/opt-out.html needs to be updated to deal with the new "sostats.mozilla.com" host. Does this also mean that users need to opt-out from both ostats.mozilla.com and sostats.mozilla.com in order to opt-out completely? Seems very lame.

Comment 7

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED for the original problem stated in comment 0 and comment 1.

Comment 8

[Reed Loden [:reed]]

Reopening to get an answer to comment #6.

Comment 9

[ken kovash]

Reed -- we've posed your question to Omniture.  we should have an answer shortly.

Comment 10

[Jeremy Orem [:oremj]]

"After speaking with one of our product managers I am told that the cookie is set for the domain - in this case Mozilla.com - and therefore should not require any additional work once you implement the SSL tracking for first party cookies."

Comment 11

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED (again ;-o) using comment 0 and comment 1 as testcases.