2.88 KB, image/png
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1 Build Identifier: Mozilla/5.0 (Windows NT 5.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1 Cert info in URL bar wrong when swiching tab from URL with correctly generated SSL cert to tab with empty SSL cert info. $ openssl s_client -connect the.bucket.cc:443 2>/dev/null < /dev/null | openssl x509 -noout -text Certificate: Data: Version: 1 (0x0) Serial Number: ff:d8:85:c8:f4:3b:94:b3 Signature Algorithm: sha1WithRSAEncryption Issuer: Validity Not Before: Dec 9 01:07:55 2010 GMT Not After : Dec 9 01:07:55 2011 GMT Subject: Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (2048 bit) Modulus (2048 bit): ... Reproducible: Always Steps to Reproduce: 1. open Firefox 4.0.1 2. open in one tab https://bugzilla.mozilla.org/ 3. open in second tab https://the.bucket.cc/ 4. switch between tabs back and forth 5. look at the url bar, near favicon 6. info there for the.bucket.cc will be shown as mozilla.org Actual Results: Wrong info for when connecting over HTTPS and cert has empty 'Subject' line. Expected Results: Probably no info for site with empty 'Subject' in SSL cert. It happens for any SSL site. I can to go https://mail.google.com/ and then back to https://the.bucket.cc/ and in URL bar it will there will be info that's cert is signed to google.com. Mouse over that info shows also wrong details.
Created attachment 530042 [details] Wroing info in URL bar and in tooltip when mouse is over favicon See attachment how does it looks in my Firefox.
confirming with FF4.01 on win32 This could be a security problem but in this case you already get a security warning before entering the site due to the self signed certificate.
yes, showing a certificate from another site on the wrong site sounds like something bad.
That is also happening when you click from site with proper cert to site with empty cert. For example here in this bug report, look at the URL bar identity and click at the following link https://the.bucket.cc/ -- URL bar identity fill not change, and still will be displayed as 'mozilla.org'.
Sorry for the forward dupe, but the other bug has more info on why this fails, and a working example (the.bucket.cc doesn't connect over here).