955315 - Intermittent but frequent occurrence of "Secure Connection Failed" errors for HTTPS sites after upgrade from 25.0 to 26.0

Status: RESOLVED WORKSFORME

(Core :: Security: PSM, defect)

Description

[Ashar]

Attachment: Firefox Secure Connection error.png

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:26.0) Gecko/20100101 Firefox/26.0 (Beta/Release)
Build ID: 20131205075310

Steps to reproduce:

- Open any HTTPS site after upgrade from 25.0 to 26.0 e.g. gmail, facebook, google
- Error page appears with error title "Secure Connection Failed"
- Or such HTTPS only load halfway through with text, frames and data missing or wrongly formatted.


Actual results:

After automatic upgrade of firefox from 25.0 to 26.0, firefox is frequently presenting the error "Secure Connection Failed" for all HTTPS based sites.

Error description:
An error occurred during a connection to www.facebook.com. SSL peer rejected a handshake message for unacceptable content. (Error code: ssl_error_illegal_parameter_alert)

    The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
    Please contact the website owners to inform them of this problem. Alternatively, use the command found in the help menu to report this broken site.

Or the pages load with errors such has half frames loaded or sections missing or wrongly formatted data.

Fallback to Firefox version 25.0 removes all such problems and all sites behave normally. Upgrade again to 26.0 reintroduces the above errors.



Expected results:

The websites should open without any problems and in proper formatting

Comment 1

[Bogdan Maris, Desktop Test Engineering]

I was unable to reproduce this issue. I opened Firefox 25, browsed a few websites (http/https), then I updated to Firefox 26, loaded a few https websites.

Comment 2

[Jefferson]

Possibly a duplicate of bug 951156 "ssl_error_illegal_parameter_alert occuring intermittently with Firefox 26".

On SuMo, the workarounds discovered so far are:

(1) Turn off the feature of your security software to filter using a "man in the middle" strategy. Kaspersky: https://support.mozilla.org/questions/980582 , 

(2) For some sites, turn off TLS and allow SSL3 only (but this is not desirable from an encryption strength perspective).

Comment 3

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Bogdan, in bug 733647 comment 74 you mentioned that you were running into this. Are you using Kaspersky on the computer you are testing this with? If not, are you using any other proxy software and/or any anti-virus software? If so, which one(s) and which version(s)?

Comment 4

[Bogdan Maris, Desktop Test Engineering]

(In reply to Brian Smith (:briansmith, :bsmith; NEEDINFO? for response) from comment #3)
> Bogdan, in bug 733647 comment 74 you mentioned that you were running into
> this. Are you using Kaspersky on the computer you are testing this with? If
> not, are you using any other proxy software and/or any anti-virus software?
> If so, which one(s) and which version(s)?

As seen in the etherpad from bug 733647 comment 74, during our testing we only got error: 'ssl_error_internal_error_alert' on two websites https://adalet.gov.tr and https://www.uyap.gov.tr. These websites use invalid security certificate, so those are website issues.
 
We have AVG AntiVirus Business Edition 2013 Version 3462 on our machines and we don`t use any proxy.

Comment 5

[Ashar]

Hello,

The issue seemed to be fixed for the subsequent updates of firefox and was specific to only version mentioned in the ticket.

Thanks.