484990 - error message should not talk about "the authenticity of the received data" when the server blames the user

Status: RESOLVED WONTFIX

(Core Graveyard :: Security: UI, defect)

Description

[timeless]

steps:
1. create an account w/ startssl
2. let it expire
3. try to log in again

actual results:

Secure Connection Failed
An error occurred during a connection to www.startssl.com.

SSL peer rejected your certificate as expired.

(Error code: ssl_error_expired_cert_alert)

The page you are trying to view can not be shown because the authenticity of the received data could not be verified.

    * Please contact the web site owners to inform them of this problem.

expected results:
since it's my fault (it's my cert that expired) and psm should know this, it shouldn't tell me that the received data couldn't be authenticated, the problem was that my sent data wasn't accepted.

Comment 1

[Kai Engert [:KaiE:]]

NSS/PSM are right, they clearly state what happened.

The phrase about authenticity is a general catch-all phrase meant to elaborate.

I think your point is to avoid inappropriate catch-all phrases or find better ones.

Comment 2

[Kai Engert [:KaiE:]]

string lives in 
  mozilla/locales/en-US/chrome/netError.dtd
and I believe is duplicated in two other app specific directories

Comment 3

[Johnathan Nightingale [:johnath]]

I think we should look at changing the psm string too (assuming we can find something that is suitably generic for PSM's consumers):

http://mxr.mozilla.org/mozilla-central/source/security/manager/locales/en-US/chrome/pipnss/nsserrors.properties

This won't make FF3.5/Gecko 1.9.1 since we are post-string-freeze.