490188 - Use fancy error codes to display detailed errors for unverified certificates

Status: RESOLVED FIXED

(Camino Graveyard :: Security, defect)

Description

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

In bug 453075, we determined that our current cert UI is not showing detailed error messages due to a Core bug.  However, we noticed that Firefox (otherwise equally afflicted) is able to show detailed error messages in the Certificate Status box when adding a cert exception.

Since the error page itself knows the proper error, and since Firefox is able to show the proper error message in the cert exception UI, we should be able to do the same (at least when adding a cert exception).

Nice-to-have for 2.0, particularly if we can do it without nib changes.

Comment 1

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

Er, bug 453075 was 2.0 already, so switching to that.

Comment 2

[Stuart Morgan]

The phrase in bug 453075 comment 3 ("not verified by a recognized authority") is just the text Firefox uses for the untrusted case that we use a more generic text (our InvalidCertMessageFormat) for. From that and looking at the code I don't think they are doing anything more than what we are now doing, which is looking at the three flavors of problems from the bad cert service: expired, domain mismatch, and untrusted.

So unless there was something else, we should either close this as WFM, or change our text post-2.0 to be more specific in the untrusted case.

Comment 3

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

http://mxr.mozilla.org/seamonkey/source/security/manager/ssl/public/nsISSLStatus.idl#55 is interesting.

That said, I think (in my tired mind), I think I concur with your analysis, and since their definition of "untrusted" is "we don't know who issued it", I think we should adapt that string in 2.1.

I think maybe the "else" was to try and use this info (either the actual NSS error code, sec_error_unknown_issuer) or the cert override service error, to replace the "we have no clue why we don't like this cert" ("The certificate could not be verified for unknown reasons") error that shows up in our certificate view itself while the "add override" sheet is displaying, i.e. to attempt to work around bug 453075 for the cert view when it's being shown in the override sheet (and for the cert views in general, but they are also shown in other situations where we don't have the cert override service handy).  I don't know if that's possible, but I think that was the other part of this bug.

Comment 4

[Stuart Morgan]

Attachment: Override dialog workaround

From some poking around, it looks like nsISSLStatus is a property of a connection, rather than a certificate, so I don't think we can use the same approach in general.

This gives us a slightly better error message in the override dialog though. It's a hack, but we don't seem to have much choice until the underlying core bug is fixed.

Comment 5

[Stuart Morgan]

Attachment: Override dialog workaround, corrected

Oops, forgot to trim out the project file change Xcode keeps wanting to add.

Comment 6

[Mike Pinkerton (not reading bugmail)]

Comment on attachment 405762 [details] [diff] [review]
Override dialog workaround, corrected

sr=pink

Comment 7

[Stuart Morgan]

Landed on CVS trunk and CAMINO_2_0_BRANCH.

Filed bug 522780 for the wording change.