575670 - Can't view security certificate when there is a certificate error

Status: RESOLVED INCOMPLETE

(Camino Graveyard :: Security, defect)

Description

[Ilya Sherman]

When you navigate to a page with a certificate error, there is no way to view the certificate (e.g. to investigate what's wrong with it).

STR
 1. Navigate to a page with a certificate error, e.g. https://www.ardisson.org/
 2. View page info

The view certificate button is disabled, but probably shouldn't be.

Comment 1

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

(In reply to comment #0)
> When you navigate to a page with a certificate error, there is no way to view
> the certificate (e.g. to investigate what's wrong with it).
...without adding an exception (we show the cert view in the exception UI).

The pre-2.0 UI did show the cert view in the sheet, which made it possible for people who cared to inspect the cert.

I think we want to hide complexity from the user by default (the old UI was bad about that), but at the same time, I think it's bad that you have to (guess that you need to) add an exception to even inspect the cert.

I'm not sure that the right solution is making Page Info enable the cert button for the error page (since the error page is indeed not encrypted), though.  Maybe we should add a button to the error page somewhere that will let us show our stand-alone cert window (like what the Certificates window shows for a cert)?

If we did that, I think we'd want it to be contingent on the new certerror UI (bug 521137) so that we could hide the button in the "technical details" section or the like.

Comment 2

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

Attachment: Non-functional skeleton fix

This looks like another "can't get there from here" bug; specifically, it looks like having the overlay up (or the underlying error state) prevents us from getting a CertificateItem (which is probably why the existing UI isn't showing anything, either).

The only thing that knows how to get a CertificateItem for a blocked site is the InvalidCertOverrideDialogController, and that's too many twists and turns into our back alleys for me to untangle.

The patch here is all set up, save for that (and strings, and CSS fine-tuning); the XUL command is handled and the BWC's method to show the cert is called; that method just can't show the cert window because it doesn't think there's a cert.

Comment 3

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

(In reply to comment #2)
> The patch here is all set up, save for that (and strings, and CSS fine-tuning);
> the XUL command is handled and the BWC's method to show the cert is called;
> that method just can't show the cert window because it doesn't think there's a
> cert.

Well, |showCertForCertificateErrorSite| really needs to take an ":(NSString*)url" just like |addCertificateOverrideForSite:| does (so we get the actual page's URL so that we can get its cert), and there's the embed-replacements->geckochrome change, but other than those, that patch is still a valid skeleton.

> The only thing that knows how to get a CertificateItem for a blocked site is
> the InvalidCertOverrideDialogController, and that's too many twists and turns
> into our back alleys for me to untangle.

More specifically, what we need here is either the first half of BrowserSecurityDialogs's |showWithSourceURL:parentWindow:delegate:| (where we do the setup and call |loadRecentBadCert|, and maybe also where we warn if the cert's been cached out) or some way to call |loadRecentBadCert| directly (but we'd still need to do some of the setup and whatnot).  (We just want the certItem to be able to load it into the regular stand-alone cert window, rather than the full override UI.)  Those methods appear to be exclusive to the InvalidCertOverrideDialogController.

Stuart, is there any sane way to untangle (share) those parts?