91864 - "unknown SSL error (-12227)"

Status: VERIFIED WORKSFORME

(Core Graveyard :: Security: UI, defect, P3)

Description

[stevenj]

I am running Debian GNU/Linux on a PowerPC (PowerBook G3), using the Mozilla
0.9.2 binary with PSM from:

http://ftp.mozilla.org/pub/mozilla/releases/mozilla0.9.2/mozilla-powerpc-unknown-linux-gnu-PSM-0.9.2.tar.gz

(Sorry, I don't know how to find the version number of PSM, or whether it is a
library or daemon for that matter; I though it was just compiled in.)

Anyway, when I try to visit the site above, which worked in previous versions (I
think it worked in 0.9.1) and works in Netscape 4.x, I get the error message:

"You cannot connect to web.mit.edu because of unknown SSL error (-12227)"

I assume this is a bug...let me know if there is any other information I can
provide.

Cordially,
Steven G. Johnson

PS. Actually accessing the above site successfully requires an MIT web
certificate, which I have (carried over from mozilla 0.9.1).

Comment 1

[Stephane Saux]

PSM version is 2.0 in 0.9.2
Reporter: have you tried a new profile? Don't forget to backup your MIT cert.
P3

Comment 2

[Stephane Saux]

Moving all P3 and P4 bugs targetted to 2.1 to future.

Comment 3

[Chris Griffith]

I was getting the same error in Mozilla 0.92 for Mac OS X 
(Build ID 2001072505). It happened when accessing MIT web 
pages that required a valid X.509 personal certificate 
issued by MIT.  It turned out that my personal certificate 
had expired.  After obtaining a new one from the CA and 
installing it in Mozilla, the error went away.

It would be great if Mozilla could provide a descriptive 
error message when a secure server refuses a connection 
due to an expired personal certificate, as Netscape 4.x does.

Comment 4

[John Unruh]

Mass assigning QA to ckritzer.

Comment 5

[Roland van Beek]

I am running Build 2001090503 on windows 2000.
I get the same error on some ssl pages.

I also use build Mozilla 0.9.3 both use the same user profile.
The 0.9.3 version works ok on the same internet page.
"https://www.abnamro.nl/toegang/aanloggen"

Comment 6

[Roland van Beek]

PS the ssl problem started around build 20010828..... (Windows version).

Comment 7

[Corey Jewett]

I was having the same issue with my web host's mail server (using IMAPS) from my
wife's Windoze Machine. The problem started when my host's certificate expired.

Interestingly it was also failing under Netscape 4.7. I upgraded her to Mozilla
build 20010801 to alieviate the problem, but no such luck. Upgrading to 9.4
20010916 didn't help any either.

Turns out that the problem resolves itself in both Netscape and Mozilla if you
delete the certificate for the site. (Thanks Chris Griffith) Anyway find the
certificate manager and delete the certificate, your problem should resolve
itself when you restart the browser.

I don't know if I should be asking for a better error message, or if it's really
a bug. But that's the workaround.

Comment 8

[John Unruh]

OS > all

Comment 9

[Tristan Colgate]

Im seeing this same error aswell with the 25/10/2001 nightly from mozillazine
when trying to talk to an STunnel proxy, also got the same error from Netscape
4.1 and 6.1. General feeling seems to point with a problem in the server side cert.

Comment 10

[R.K.Aa.]

*** Bug 111724 has been marked as a duplicate of this bug. ***

Comment 11

[Chris Kuklewicz]

FYI
I got this error (-122227) when I had no personal certificates
imported in Mozilla (0.9.7) and I tried to access MIT ssl pages
that required my certificate.

Once I exported / imported the Netscape 4.x certificate it worked
without a hitch.

So for me this is an "unclear error message" bug - the server
must have required a cert and mozilla had zero certificates to
offer, and showed a cryptic error code.  This failure mode ought
to eventually have a better error message.

Perhaps unkown numerical error messages should point to a mozilla.org
page (http://errorcodes.mozilla.org/ssl#-12227) which would aid the
user (and generate useful debuggin statistics).
Or just use the talkback feature.

Comment 12

[John Unruh]

Marking WFM. Error messages should now be explained in text instead of an error 
number. Error -12227 is: "SSL peer was unable to negotiate an acceptable set of 
security parameters."

Comment 13

[John Unruh]

Verified.