914539 - [Buri][Shira-48042][Email]Handset is unwilling to connect to any servers that have unknown server certifcates

Status: RESOLVED DUPLICATE of bug 874346

(Firefox OS Graveyard :: Gaia::E-Mail, defect, P2)

Description

[sync-1]

Firefox os  v1.1
  Mozilla build ID:20130828041203
 
 DEFECT DESCRIPTION:
 Handset is unwilling to connect to any servers that have unknown server
 certifcates
 
 REPRODUCING PROCEDURES:
 Email servers are frequently issued with invalid certifcates (e.g. wrong CN,
 invalid issuer, expired) so operation of email with invalid certifcates is very
 important.
 But currently when device encounters an unknown server certificate then just
 stops connecting and gives an error message like unable to connect unknown
 error. which is not very clear to user why it is not working. User can max
 think about a wrong userid or password. Where as the root cause is something
 different. So user will never be able to connectthe server neither will be able
 to know what is going wrong.
 
 Customer Impact Statement: 
 If the customer attempts to use an email server that has an invalid certifcate
 it will not work. The user does not get any feedback explaining the reason why,
 however if they change to plain text the account will verify.
 
 This is also required for us to test the device in our test environment.
 Because of this issue many of the testing can't be done.
 
 
 EXPECTED BEHAVIOUR:
 Mobile should give suitable prompt.
 
 
 ASSOCIATE SPECIFICATION:
 
 TEST PLAN REFERENCE:
 
 TOOLS AND PLATFORMS USED:
 
 USER IMPACT:
 mid
 REPRODUCING RATE:
 5/5
 For FT PR, Please list reference mobile's behavior:

Comment 1

[Andrew Sutherland [:asuth] (he/him)]

A bad-security error should be generated, not an unknown error.  The English string for the error is currently: Unable to establish a secure connection with "{{server}}". There may be a problem with your network or the server.

Please see https://bugzilla.mozilla.org/show_bug.cgi?id=874346#c11 for the current state of thinking on this general class of certificate problems.

There should be no way for the user to create an unencrypted / 'plain' connection.  If you've found a way, please describe it, because it is a serious bug.