52799 - Endless Unexpected Cert Name windows

Status: VERIFIED WONTFIX

(Core Graveyard :: Security: UI, defect, P1)

Description

[John Unruh]

Linux and Win98 9/15 builds.
1.) Visit https://www.kmart.com
What is expected: Two Unexpected Cert Name windows to click through, as it 
happens with Netscape 4.76 with or without PSM.
What happens: More Unexpected Cert Name windows keep opening in Win98. I count 
16 before the browser locks up. In linux, the browser just locks up right away.

Comment 1

[Michael La Guardia]

marking nsbeta3+.  It seems to me that this is as good as a hang on a major
site.  Setting to P1

Comment 2

[Michael La Guardia]

Marking nsbeta3-, won't hold PR3 for this.  Nominating for rtm.  FWIW, I didn't
get the multiple dialog problem.

Comment 3

[Javier Delgadillo]

What we've found is that https://www.kmart.com in actuality fetches 
https://www.bluelight.com

bluelight.com appears to have many machines to handle the load on the site and 
each machine has its own certificate.  So when you go to the page, depending on 
current traffic, you may hit 1 or more of the machines.  That number corresponds 
to the number of dialogs you should see.  With Comm 4.x w/ PSM, I went to the 
site and got 2 warnings.  With N6/Mozilla, unfortunately I get and endless 
stream of warnings.

FWIW, I could not load https://www.kmart.com using IE 4

Comment 4

[David P. Drinan]

Adding [rtm need info] to whiteboard.

Comment 5

[David P. Drinan]

The kmart site is broken in two ways. The first is the DN mismatch (the site is 
www.kmart.com, its SSL cert is www.bluelight.com). This first problem is not 
such a big deal (we just throw up a name mismatch dialog) but it is compounded 
by a second problem that site has. The site uses an SSL loadbalancer, so when 
N6 loads the main page of www.kmart.com, it connects to five or six different 
machines, each of which has its own SSL certificate with the wrong DN. This 
causes multiple Cert Name Mismatch dialogs to show.

For us to fix this would require a major changes to NSS or have PSM serialize 
SSL connections (a big performance hit).

I'm inclined to not fix this and recommend a workaround of loading 
https://www.bluelight.com instead.

Comment 6

[Bob Lord]

I just tried to access https://www.kmart.com/ using IE 5.5.  IE returns an error
which says "The page cannot be displayed".

I just tried https://www.bluelight.com using N6.  That works fine, and no error
messages pop up.

I agree that any change (which we don't yet have) would be high risk.

Comment 7

[David P. Drinan]

Marking thus rtm-.

Comment 8

[John Unruh]

Marking wontfix. The URL is no longer valid, and I haven't been able to 
reproduce this on any other site.

Comment 9

[John Unruh]

Verified.

Comment 10

[John Unruh]

Mass changing Security:Crypto to PSM

Comment 11

[John Unruh]

Mass changing Security:Crypto to PSM