436318 - Certificate exception dialog is confusing to use on a non-browser client (i.e. Thunderbird)

Status: RESOLVED DUPLICATE of bug 378004

(MailNews Core :: Security, defect)

Description

[Dave Miller [:justdave]]

I just set up a new account on a Thunderbird 3 alpha build.  As with most mail providers, the certificate is either self-signed, or in my case, on shared hosting so it's guaranteed to have a hostname mismatch.

We have two problems:

Problem 1:
  Thunderbird displays "The certificate is not valid because the host name does not match" or something similar to that, in a modal dialog sheet, with nothing but an OK button.  Basically, there is *no* way to override this from the Check Mail activity, it just plain out refuses to let you in.  But that's bug 429843, and can be discussed there.

Problem 2: (what this bug is actually about)
  If you manually go to Preferences > Advanced > Certificates > View Certificates > Servers > Add Exception..., you are prompted for a URL to grab the certificate from.  I'm using a mail client, so my first attempt was "pop3s://a1.postal.mail.dreamhost.com".  It just sat there and timed out at "Attempting to retrieve certificate".  I never did get any message saying why (I let it sit for a few minutes).  Entering "https://a1.postal.mail.dreamhost.com:995" worked, but this is not by any means discoverable.

For non-browser clients, it would make much better sense to ask for a domain name and a port number, than to ask for a URL.  A checkbox for "Use STARTTLS" would probably be useful as well, in a mail server context (and that gets tricky because there's a different way to do STARTTLS for all three of IMAP, POP3, and SMTP).  If we allow the "Add exception" to be linked from the error dialog (as bug 429843 is suggesting), all of that information will be available to the client at that point (whether it's SSL or STARTTLS and which protocol is being attempted) and could easily be prefilled.

Re: flags: this should be blocking-thunderbird3, but it's not letting me request that for some reason (it's visible but grayed out).  It should be triaged for that and not actually blocking1.9

Comment 1

[Mike Beltzner [:beltzner, not reading bugmail]]

Yeah, I don't know what components blocking-thunderbird3 is on - at any rate, this isn't blocking1.9, but might block whatever version of Gecko ends up being used for Thunderbird 3.

Comment 2

[Dan Mosedale (:dmosedale, :dmose)]

Requesting wanted-1.9.1, as this UI doesn't really make much sense for non-browser apps.

Comment 3

[Thomas Whaples]

I just ran into this as well, but with the dialog not accepting ldaps:// for the address book. I was lucky enough to be inspired to find the port number hack, though.

cf. http://superuser.com/questions/106766/how-can-i-get-thunderbird-to-import-a-secure-ldap-certificate

Comment 4

[Kai Engert [:KaiE:]]

I've never been happy with the idea to produce application UI for each application and protocol separately. I've worked on an idea to make certificate exceptions possible in general, without requiring the frowned-upon click-through prompts.

In short, my proposal is to use a status bar (or elsewhere) icon that indicates there have been problems with (a) bad server certificate(s), and jump to the exception dialog from there. This follows the desire that certificate exceptions should be produced deliberately, not by "I don't care, go ahead, OK" prompts.

This general proposal is described in the *second* document at http://kuix.de/mozilla/sslauth/


That having said, yes I agree with this bug, the current situation is confusing, and I apologize for not yet having helped to contribute to a better implementation.


While the current exception-dialog is clearly a product designed for a web browser, the more general add-exception dialog could be re-designed to avoid talking about an "URL" (which makes no sense to most users outside the web browser context) and make it more obvious that we need hostname, port number (or procotol).

Comment 5

[Dana Keeler (she/her) [:keeler]]

Each product has different needs in this area. I don't think the certificate exception dialog should actually be shared across them. If Thunderbird needs to improve how it works, they need to implement their own version of it.