46810 - Unable to use PSM with Mozilla nightly build from 072700.

Status: VERIFIED DUPLICATE of bug 31174

(Core Graveyard :: Security: UI, defect, P3)

Description

[Rich Burridge]

I've been trying to use PSM with a nightly build of Mozilla from 072700.
I've been trying to go to an internal secure site http://orgtool.central/
Via Edit->Preferences, I removed the proxy for SSL and then clicked Ok.

I entered the URL, and it brings up a panel labeled "New Web Site Certificate:
Step 1." I clicked on the Next button, and that panel goes away, and another
appears "New Web Site Certificate: Step 2", asking if I want to accept the
certificate. I clicked on the Finish button, but the page did not appear.

I then went to Edit->Preferences, and adjusted the Advanved->Proxies to be
a direct connection to the Internet and clicked Ok.

I then hit return in the Url field (to retry going to the site), but no
panels for certificate acception were displayed and it did not go to that URL.

I will attach the debug messages from the console log. Lot's of XUL and JS
errors.

Comment 1

[Rich Burridge]

Attachment: Debug messages sent to the console whilst trying PSM.

Comment 2

[John Unruh]

Rich, try more than one secure site, like https://www.verisign.com and 
https://www.thawte.com

Comment 3

[Rich Burridge]

I've just tried the following.

* As we have a firewall here at Sun, I went to Edit->Preferences
  and under Advanced->Proxies, I added an SSL: proxy of webcache-cup
  (port 8080), which is the same as the http and ftp proxies, and works fine
with Netscape 4.74.

  I then entered a URL of https://www.verisign.com/

It displays the error message:

Error

  The requested item could not be loaded by the proxy
  Communication exception (-8162)

Proxy server at webcache-cup.eng at port 8080

I then entered a URL of https://thawte.com and got the same error message.

I will attach the console log.

junruh, are you trying this with Mozilla on the Solaris platform. If so,
what rev of the O/S?

Comment 4

[Rich Burridge]

Attachment: Console log when trying to visit two https: sites

Comment 5

[John Unruh]

This looks like a dupe of http://bugzilla.mozilla.org/show_bug.cgi?id=31174
"SSL requests not going to proxy". Rich, try going to https://www.verisign.com 
and https://www.thawte.com without using a proxy. If you can reach those sites, 
this bug should stay as "worksforme".

Comment 6

[Rich Burridge]

Okay, I've just tried the following.

* I did Edit->Preferences, and under Advanced->Proxies, and Manual Proxy
  Configuration, I removed the SSL proxy name and port number, and clicked ok.

* I then entered a URL of https://www.verisign.com/
 
It displays an Alert:

www.verisign.com could not be found. Please check the name and try again.

I will attach the debug messages for this run too.

Comment 7

[Rich Burridge]

Attachment: Debug messages for trying to visit www.verisign.com without an SSL proxy entry.

Comment 8

[drapeau]

junruh, rich: Rich cannot use the URL's http://www.verisign.com and 
http://www.thawte.com because he's running the browser from inside the Sun 
firewall.  The *only* access to outside sites is via a web proxy.  That is why 
his bug report mentions the Sun-internal web site http://orgtool.central.sun.com 
(although his name wasn't fully-qualified).

Can anybody at Netscape try this out on Solaris themselves against verisign or 
thawte?  I saw no evidence that somebody did this on Solaris before marking the 
bug WORKSFORME.

Help?

Comment 9

[Rich Burridge]

Working with salsero on IRC, we've successfully connected to
https://javi.red.iplanet.com. Here's the chat session:

<salseroMsgMe> Can you reach the red.iplanet.com domain directly?  (ie not throu
gh a proxy) 
<salseroMsgMe> specifically https://javi.red.iplanet.com:8080
<richb> i've just updated 46810 with a similar try to www.verisign.com (the QA g
uy asked me to do that). I'll now try your suggested site. hang on...
<richb> hey. i get something different. 
<richb> it's bought up a popup New Web Site Certificate 1. I'm just about to cli
ck on Next.
<richb> It's now displayed New Web Site Certificate Step 2. I'm just about to cl
ick on Finished.
<richb> It's now displayed an unexpected certificate name popup. Would you like 
me to view the web site certificate?
<salseroMsgMe> go ahead and accept for that session
<richb> you mean click on the "Continue Anyway" button, yes?
<salseroMsgMe> yes
<richb> okay. hang on...
<salseroMsgMe> (I never got a new cert after we moved from Mountain View, that's
 why you're seeing that.)
<richb> I now get an alert saying "The operation timed out when attempting to co
ntact javi.red.iplanet.com".
<richb> Should I try it again (only faster ;-) ?
<salseroMsgMe> sure
<richb> hey, it's displayed the page!

----

I'll attach the debug message log file now.

Comment 10

[Rich Burridge]

Attachment: Log of debug messages for successful visit to https://javi.red.iplanet.com:8080

Comment 11

[John Unruh]

I didn't notice that this was a Solaris bug when marking it worksforme. Rich or 
drapeau, please reopen or verify this bug depending upon your findings.

Comment 12

[Rich Burridge]

Reopening bug. What needs to be determined is why it was able to successfully
go to https://javi.red.iplanet.com:8080/ (which would appear to be
outside the firewall), but not able to go to verisign or thawte.

Hopefully the attached debug message log files might be of use here.

Comment 13

[Javier Delgadillo]

javi.red.iplanet.com is inside the iPlanet firewall which includes Sun and 
Netscape employees.  So you were actually connecting to a machine inside the 
firewall.

Comment 14

[Rich Burridge]

javi, then it looks like we simply might be hitting bug 31174, yes?

Comment 15

[Javier Delgadillo]

I believe so.

Comment 16

[David P. Drinan]

Setting keyword to nsbeta3

Comment 17

[John Unruh]

*** This bug has been marked as a duplicate of 31174 ***

Comment 18

[John Unruh]

Verified dupe.