From debbugs-submit-bounces@debbugs.gnu.org Tue Sep 25 00:29:45 2018 Received: (at submit) by debbugs.gnu.org; 25 Sep 2018 04:29:45 +0000 Received: from localhost ([127.0.0.1]:52713 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1g4eym-0004pe-VL for submit@debbugs.gnu.org; Tue, 25 Sep 2018 00:29:45 -0400 Received: from eggs.gnu.org ([208.118.235.92]:38571) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1g4eyk-0004pP-Mf for submit@debbugs.gnu.org; Tue, 25 Sep 2018 00:29:43 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1g4eye-0001Jm-Gs for submit@debbugs.gnu.org; Tue, 25 Sep 2018 00:29:37 -0400 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org X-Spam-Level: X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00 autolearn=disabled version=3.3.2 Received: from lists.gnu.org ([2001:4830:134:3::11]:44718) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1g4eyc-0001IV-8A for submit@debbugs.gnu.org; Tue, 25 Sep 2018 00:29:35 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:48032) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1g4eyb-0001TP-DR for bug-guix@gnu.org; Tue, 25 Sep 2018 00:29:34 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1g4esL-00052y-Mo for bug-guix@gnu.org; Tue, 25 Sep 2018 00:23:06 -0400 Received: from fencepost.gnu.org ([2001:4830:134:3::e]:49375) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1g4esL-00052m-HC for bug-guix@gnu.org; Tue, 25 Sep 2018 00:23:05 -0400 Received: from localhost ([::1]:58178 helo=mikegerwitz-pc.gerwitz.local) by fencepost.gnu.org with esmtps (TLS1.2:DHE_RSA_AES_128_CBC_SHA1:128) (Exim 4.82) (envelope-from ) id 1g4esK-0001WR-BH for bug-guix@gnu.org; Tue, 25 Sep 2018 00:23:05 -0400 From: Mike Gerwitz To: bug-guix@gnu.org Subject: IceCat 60 showing sites as "insecure" despite using HTTPS Date: Tue, 25 Sep 2018 00:22:24 -0400 Message-ID: <87k1nadx4v.fsf@gnu.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/25.3 (gnu/linux) OpenPGP: id=22175B02E626BC98D7C0C2E5F22BB8158EE30EAB MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha512; protocol="application/pgp-signature" X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6.x X-Received-From: 2001:4830:134:3::11 X-Spam-Score: -5.0 (-----) X-Debbugs-Envelope-To: submit X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -6.0 (------) --=-=-= Content-Type: text/plain Content-Transfer-Encoding: quoted-printable I don't know if this is a problem specific to Guix or upstream; I can give IceCat a try in a Debian VM tomorrow. But I want to make others aware of the problem in the meantime: Even if sites are using HTTPS, IceCat is still saying "This connection is insecure" if you click on the "i" icon in the URL bar. This seems to be a problem with every HTTPS site I visit. On the "Security" tab of the "Page Info" dialog, under "Technical Details", no certificate information is listed; it simply says "Connection Not Encrypted". That's clearly not true, otherwise the page would fail to load. I've tried with sites that use HSTS and don't even support plaintext connections (e.g. my own)---the pages load just fine. I haven't played around with sites with expired certificates or anything yet. But if IceCat is not reporting security status correctly, then users may be at risk, so be careful in the meantime! =2D-=20 Mike Gerwitz Free Software Hacker+Activist | GNU Maintainer & Volunteer GPG: D6E9 B930 028A 6C38 F43B 2388 FEF6 3574 5E6F 6D05 https://mikegerwitz.com --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCgAGBQJbqbgAAAoJEIyRe39dxRuiUCAQAK7X0IkzrupMHKTepe8Hk6kk oCQVWJPNaMcwEknghYFISg7LZJmP7AtlujzkTv85A4dvzeQKbMuOklQcJ3wbVmju PdxNThdSHJ/jGsDHM/P3spberUP+rC8XtFqGFefGHLdF0//PaLXwncEK8ePvUpai Y0EpyAiEl18B54sTNPijFA4jEXvNsaxnH87AdjcRLdb08M6DkShG6ND0VcAbdq8O 5HBkmr2USH/bJx7aatR3ItT9uMR4vaaCJ9j+6iMEltZAmWPVum8Jcj/AmKeNgBKf t+tBQftuzW6N7kV5TGcY6J2ROaMp5TI32PQCYpmAyYY8vaDEb26PDZDaIZ4aDDtj 9Ay1aSjyrLQBLo002gKEvIkcnOQpoafHSc+BJAGbb3qZRn2QQ0oh99wOZWh9pRWv jRI4Ts5DXBGMM/KPk2uNQvoworaZW11h3w2t8xAS3UqA0Z7xBt5idXBXK8M/NhUg Qs2G8FTR6PyqF6LMhGlFjfHe21gsJ/aUf20RFw8lUdJWSG+Etpxqj4ayPpcmHfZh 1i/KZlfktAu4FLp/lqlqfdcVxJfVf1fL5M9WZ4zYlRCAh+SmZb7n/L7dbTPAzmOO vQpaetoNjxpgzpP3cqHpibk9X9c1BYGDlvcWWRIO3YhZ1M4NiGe13//GMTaDFbgs oxu8drjYbE/EltEfw4CA =Iw+E -----END PGP SIGNATURE----- --=-=-=-- From debbugs-submit-bounces@debbugs.gnu.org Tue Sep 25 18:01:37 2018 Received: (at 32833) by debbugs.gnu.org; 25 Sep 2018 22:01:37 +0000 Received: from localhost ([127.0.0.1]:54134 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1g4vOj-0004eS-Ft for submit@debbugs.gnu.org; Tue, 25 Sep 2018 18:01:37 -0400 Received: from world.peace.net ([64.112.178.59]:42060) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1g4vOg-0004e7-PP; Tue, 25 Sep 2018 18:01:35 -0400 Received: from mhw by world.peace.net with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.89) (envelope-from ) id 1g4vOZ-0002kQ-W6; Tue, 25 Sep 2018 18:01:28 -0400 From: Mark H Weaver To: Mike Gerwitz Subject: Re: bug#32833: IceCat 60 showing sites as "insecure" despite using HTTPS References: <87k1nadx4v.fsf@gnu.org> Date: Tue, 25 Sep 2018 18:01:19 -0400 In-Reply-To: <87k1nadx4v.fsf@gnu.org> (Mike Gerwitz's message of "Tue, 25 Sep 2018 00:22:24 -0400") Message-ID: <87o9clck40.fsf@netris.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.1 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain X-Spam-Score: 0.0 (/) X-Debbugs-Envelope-To: 32833 Cc: 32833@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) severity 32833 critical thanks Hi Mike, Mike Gerwitz writes: > Even if sites are using HTTPS, IceCat is still saying "This connection > is insecure" if you click on the "i" icon in the URL bar. This seems to > be a problem with every HTTPS site I visit. > > On the "Security" tab of the "Page Info" dialog, under "Technical > Details", no certificate information is listed; it simply says > "Connection Not Encrypted". That's clearly not true, otherwise the page > would fail to load. I've tried with sites that use HSTS and don't even > support plaintext connections (e.g. my own)---the pages load just fine. > > I haven't played around with sites with expired certificates or anything > yet. But if IceCat is not reporting security status correctly, then > users may be at risk, so be careful in the meantime! Thanks for reporting this. I see the same problem, which is a surprise. I would have expected some notification that something went wrong, but I don't remember any. Given the severity of this issue, we should prioritize deploying a working fix ASAP, even if it's an ugly hack or workaround. To begin, I'm currently building IceCat using the bundled NSPR and NSS, to see if that helps. If that fails, I'll look more closely at IceCat's customizations to the default "about:config" settings. The 'strace' output might also have some clues. I would welcome others to make their own efforts to find a fix for this issue, or to share their ideas. > I don't know if this is a problem specific to Guix or upstream; I can > give IceCat a try in a Debian VM tomorrow. Please do. It would be _very_ helpful to know if this problem is Guix-specific. Thanks, Mark From debbugs-submit-bounces@debbugs.gnu.org Tue Sep 25 20:16:33 2018 Received: (at 32833) by debbugs.gnu.org; 26 Sep 2018 00:16:33 +0000 Received: from localhost ([127.0.0.1]:54205 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1g4xVI-0001hP-PD for submit@debbugs.gnu.org; Tue, 25 Sep 2018 20:16:33 -0400 Received: from world.peace.net ([64.112.178.59]:42440) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1g4xVH-0001hD-8H for 32833@debbugs.gnu.org; Tue, 25 Sep 2018 20:16:31 -0400 Received: from mhw by world.peace.net with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.89) (envelope-from ) id 1g4xVB-0003gw-BO; Tue, 25 Sep 2018 20:16:25 -0400 From: Mark H Weaver To: Mike Gerwitz Subject: Re: bug#32833: IceCat 60 showing sites as "insecure" despite using HTTPS References: <87k1nadx4v.fsf@gnu.org> <87o9clck40.fsf@netris.org> Date: Tue, 25 Sep 2018 20:16:16 -0400 In-Reply-To: <87o9clck40.fsf@netris.org> (Mark H. Weaver's message of "Tue, 25 Sep 2018 18:01:19 -0400") Message-ID: <87a7o5cdv3.fsf@netris.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.1 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain X-Spam-Score: 0.0 (/) X-Debbugs-Envelope-To: 32833 Cc: 32833@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) Mark H Weaver writes: > To begin, I'm currently building IceCat using the bundled NSPR and NSS, > to see if that helps. Using the bundled NSPR and NSS works around the problem for me. I just pushed this change in commit 6d328879378fac95240005233331f596fb5c68ed on 'master'. See also the related, immediately preceding commits 257e3247910610fe24ae1b86f38e85552d53e48c and 94e96f7f68c3b9053fdb5dee5b0ab614163aaa08. I'm keeping this bug report open, since it would be good to find a better fix which avoids using the bundled libraries. Mark From debbugs-submit-bounces@debbugs.gnu.org Tue Sep 25 20:34:17 2018 Received: (at 32833) by debbugs.gnu.org; 26 Sep 2018 00:34:17 +0000 Received: from localhost ([127.0.0.1]:54231 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1g4xmT-00029u-C7 for submit@debbugs.gnu.org; Tue, 25 Sep 2018 20:34:17 -0400 Received: from eggs.gnu.org ([208.118.235.92]:49280) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1g4xmR-00029c-WA for 32833@debbugs.gnu.org; Tue, 25 Sep 2018 20:34:16 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1g4xmM-00012a-6a for 32833@debbugs.gnu.org; Tue, 25 Sep 2018 20:34:10 -0400 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org X-Spam-Level: X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00 autolearn=disabled version=3.3.2 Received: from fencepost.gnu.org ([2001:4830:134:3::e]:42748) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1g4xmM-00012S-1n; Tue, 25 Sep 2018 20:34:10 -0400 Received: from localhost ([::1]:51551 helo=mikegerwitz-pc.gerwitz.local) by fencepost.gnu.org with esmtps (TLS1.2:DHE_RSA_AES_128_CBC_SHA1:128) (Exim 4.82) (envelope-from ) id 1g4xmK-00085i-Kt; Tue, 25 Sep 2018 20:34:09 -0400 From: Mike Gerwitz To: Mark H Weaver Subject: Re: bug#32833: IceCat 60 showing sites as "insecure" despite using HTTPS In-Reply-To: <87a7o5cdv3.fsf@netris.org> (Mark H. Weaver's message of "Tue, 25 Sep 2018 20:16:16 -0400") Date: Tue, 25 Sep 2018 20:30:57 -0400 Message-ID: <87tvmdcd6m.fsf@gnu.org> References: <87k1nadx4v.fsf@gnu.org> <87o9clck40.fsf@netris.org> <87a7o5cdv3.fsf@netris.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/25.3 (gnu/linux) OpenPGP: id=22175B02E626BC98D7C0C2E5F22BB8158EE30EAB MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha512; protocol="application/pgp-signature" X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 2001:4830:134:3::e X-Spam-Score: -5.0 (-----) X-Debbugs-Envelope-To: 32833 Cc: 32833@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -6.0 (------) --=-=-= Content-Type: text/plain Content-Transfer-Encoding: quoted-printable On Tue, Sep 25, 2018 at 20:16:16 -0400, Mark H Weaver wrote: > Mark H Weaver writes: >> To begin, I'm currently building IceCat using the bundled NSPR and NSS, >> to see if that helps. > > Using the bundled NSPR and NSS works around the problem for me. I just > pushed this change in commit 6d328879378fac95240005233331f596fb5c68ed on > 'master'. See also the related, immediately preceding commits > 257e3247910610fe24ae1b86f38e85552d53e48c and > 94e96f7f68c3b9053fdb5dee5b0ab614163aaa08. Great! > I'm keeping this bug report open, since it would be good to find a > better fix which avoids using the bundled libraries. I wish I knew enough to suggest a better solution. It's a little late now, but I just tested the IceCat binary on a Debian machine and HTTPS works as expected. Thanks again for your work on this. Maybe I'll let IceCat build overnight so I can give it a try tomorrow (still on my X200). =2D-=20 Mike Gerwitz --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCgAGBQJbqtNBAAoJEIyRe39dxRuiFqIQAIqBbCWEhiXsRYrh9XuQdRL3 YgkfjY73bmxdSHeb9WyX2buzdiZ0V7vZo2rR3lV+tAPmu72ZUF/KzrsgIxervJ3V Sd6lnevtT8fZugP7BP+mgSocM0N+4mtUl0kH7wq4MOOGGc+S0TAlDq7ph2yWmQoA hrUu/FrMkPGASSiGP8+TY6vU3ZfDCf6FeS86zLfUUy75LB5vytM90XntTDGl0P0H jALgaZLRYHAuztcgQIAzmAGatWcIBZCAYH3s5ZBgI7A1usne20JXhOHmWugFL91X fFJUn++pA9VV085MIfPwjTKZnehfWEK/bt5gFVJmJUiT1C76kosdvOrHBxmU17yz YY/hLbdgX4nKNGsmleEiU3HAbsCs4HVJ0dIUYx5PAGM7S/ykv13s3xKthmh5Vc99 u25bDmWcx5lon81sMxjnOZZ5t6W5I1HzQlJw64q3B9pZAoyf55rX7wMKLtx+csHT rE16d2BZVwWs9cGmROkdSrkHVt3w2jaJr6aDj27uOe9cZUkrP8XfClKru5r4zcLg +16yz5C5AbkvRFzXojb/jmYllQRTVvYOJ8kz8RXWDxF5ixsjd6uAilvfWLxyuq00 AqTV+VRZ5yS1GWSsrErT0iC9CbH/BdqC9jYJMb0Gnass8Ggo41scS3iC2P7gU1Kx iNzxT08dKcOBtrOTa/gh =Rsuf -----END PGP SIGNATURE----- --=-=-=-- From debbugs-submit-bounces@debbugs.gnu.org Wed Sep 26 00:56:30 2018 Received: (at 32833) by debbugs.gnu.org; 26 Sep 2018 04:56:30 +0000 Received: from localhost ([127.0.0.1]:54292 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1g51sC-0000If-6z for submit@debbugs.gnu.org; Wed, 26 Sep 2018 00:56:30 -0400 Received: from eggs.gnu.org ([208.118.235.92]:60977) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1g51sA-0000IR-7O for 32833@debbugs.gnu.org; Wed, 26 Sep 2018 00:56:26 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1g51s1-0002D8-7N for 32833@debbugs.gnu.org; Wed, 26 Sep 2018 00:56:18 -0400 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org X-Spam-Level: X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00 autolearn=disabled version=3.3.2 Received: from fencepost.gnu.org ([2001:4830:134:3::e]:47137) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1g51rz-0002B5-AZ; Wed, 26 Sep 2018 00:56:16 -0400 Received: from localhost ([::1]:55938 helo=mikegerwitz-pc.gerwitz.local) by fencepost.gnu.org with esmtps (TLS1.2:DHE_RSA_AES_128_CBC_SHA1:128) (Exim 4.82) (envelope-from ) id 1g51rx-0006xg-5B; Wed, 26 Sep 2018 00:56:15 -0400 From: Mike Gerwitz To: Mark H Weaver Subject: Re: bug#32833: IceCat 60 showing sites as "insecure" despite using HTTPS In-Reply-To: <87tvmdcd6m.fsf@gnu.org> (Mike Gerwitz's message of "Tue, 25 Sep 2018 20:30:57 -0400") Date: Wed, 26 Sep 2018 00:55:07 -0400 Message-ID: <87bm8kdfis.fsf@gnu.org> References: <87k1nadx4v.fsf@gnu.org> <87o9clck40.fsf@netris.org> <87a7o5cdv3.fsf@netris.org> <87tvmdcd6m.fsf@gnu.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/25.3 (gnu/linux) OpenPGP: id=22175B02E626BC98D7C0C2E5F22BB8158EE30EAB MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha512; protocol="application/pgp-signature" X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 2001:4830:134:3::e X-Spam-Score: -5.0 (-----) X-Debbugs-Envelope-To: 32833 Cc: 32833@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -6.0 (------) --=-=-= Content-Type: text/plain Content-Transfer-Encoding: quoted-printable On Tue, Sep 25, 2018 at 20:30:57 -0400, Mike Gerwitz wrote: > Thanks again for your work on this. Maybe I'll let IceCat build > overnight so I can give it a try tomorrow (still on my X200). LGTM. =2D-=20 Mike Gerwitz --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCgAGBQJbqxErAAoJEIyRe39dxRuiA0gQAJdJ1nmejq59J3DkKNuA9E5Z gVrXi+GbU03JG64ZD5GFCViN9LNOTxrXX2/N+80TRysZTI01uzs8xsBLszT0gSKy P4u1Apfrhlez0ny6YiRywXTNJo2oejh4/eUOLRpqMlf51F0Uleaygfo87Xs/dmwm PLJRnpYTgvcb2ct+MbLjeWXsXTEJE+6pD8jtviXPpPSZgvT4+BkKL3O27h5rnMVc 4rq3oQxGGfwFd4bVNwF2nPp2nPfLPOpMQQVqcC/+ztfUmC2HR7YqCmeoOSBbQpAs xzNnQiHiAdmtHqmNuOHKTqx9nHorrAPCFpUR/PmTEtub+M+HjHZEINptPXwWilaH jnx/ItEuRBdEoCI0xW0F+8HsQie/h9Dprp1j9ZVbdJBld4zYaZvT5CnbjBlP4AQS HK1HfjnkrtRU3yzOP4L8f93YJKYGN+LhoV58/MpFIcBBEX/vFHrD6vGJmDK1W0mY KspcxZYZlKI4IT2ce+K1+duQGHrtb+QQYXaXXCtYl8gcXSNcr9GPfueGyihe47hu zv75RMvy0O8mig4ZpEKSjQPwqlsdTEdR2FeS7BwNdZDsxCb4xbxPAqaKu98RRaOO HJUXBv/B7d5HnC5gteDvVVZ3qA7QnQJBusrxXujv6IWVFQXD8mCN6B4mQvPxEazL tbgLcoJvFu3u3kv1/y7+ =QsOk -----END PGP SIGNATURE----- --=-=-=-- From debbugs-submit-bounces@debbugs.gnu.org Wed Sep 26 18:49:48 2018 Received: (at control) by debbugs.gnu.org; 26 Sep 2018 22:49:48 +0000 Received: from localhost ([127.0.0.1]:55746 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1g5Icu-0001xs-GR for submit@debbugs.gnu.org; Wed, 26 Sep 2018 18:49:48 -0400 Received: from world.peace.net ([64.112.178.59]:38478) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1g5Ics-0001xd-OI for control@debbugs.gnu.org; Wed, 26 Sep 2018 18:49:47 -0400 Received: from mhw by world.peace.net with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.89) (envelope-from ) id 1g5Icm-0001KS-Th; Wed, 26 Sep 2018 18:49:41 -0400 From: Mark H Weaver To: control@debbugs.gnu.org User-Agent: Emacs/26.1 (x86_64-unknown-linux-gnu) Date: Wed, 26 Sep 2018 18:49:24 -0400 Message-ID: <87h8ibho23.fsf@netris.org> MIME-Version: 1.0 Content-Type: text/plain X-Spam-Score: 2.0 (++) X-Spam-Report: Spam detection software, running on the system "debbugs.gnu.org", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: retitle 32833 IceCat 60 certificate validation fails when using system NSS severity 32833 normal thanks [...] Content analysis details: (2.0 points, 10.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 1.8 MISSING_SUBJECT Missing Subject: header 0.2 NO_SUBJECT Extra score for no subject X-Debbugs-Envelope-To: control X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: 1.0 (+) retitle 32833 IceCat 60 certificate validation fails when using system NSS severity 32833 normal thanks From debbugs-submit-bounces@debbugs.gnu.org Mon Aug 28 23:40:43 2023 Received: (at 32833-done) by debbugs.gnu.org; 29 Aug 2023 03:40:44 +0000 Received: from localhost ([127.0.0.1]:49289 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1qapap-0002Jm-VT for submit@debbugs.gnu.org; Mon, 28 Aug 2023 23:40:43 -0400 Received: from mail-qk1-x730.google.com ([2607:f8b0:4864:20::730]:59650) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1qapan-0002JW-SL for 32833-done@debbugs.gnu.org; Mon, 28 Aug 2023 23:40:38 -0400 Received: by mail-qk1-x730.google.com with SMTP id af79cd13be357-76f1212228bso100524385a.3 for <32833-done@debbugs.gnu.org>; Mon, 28 Aug 2023 20:40:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20221208; t=1693280425; x=1693885225; h=mime-version:user-agent:message-id:in-reply-to:date:references :subject:cc:to:from:from:to:cc:subject:date:message-id:reply-to; bh=7Ey6/lRvdJAQZBk+5/GdPtT1s5z9nb99Q6n/BiVAaRs=; b=aImgRj+DlV4PgD6l0BJzFX61JL4x2NSKeSL09K15wPOg4HeYhh9K/g+Oyoc0uR/evp QRpXixoXXMW/Mj8J33gvI2+rs1U7d7xaR8TMweczPpqA1NL8d0MMqFNiCTcDpf1oNeZ6 Na2AiYkQDQygV5XaWhGR/MV46IVzV8oOJF+pMN7jIJ6I9f9Dn9u8rrhai1Wf8HkBC8b9 c3GjowRACAa8bL8cPyFur4PiReEszZMbAEDC7Zxi54bZOb/uOjLIGi/kAzWNBsAfobWa VKsyU9ebM5T5WXlX7aR8dI76VFxIy966b2CYsL+4jLv1z+TB8GenCs4NaliCFxNiKU7V YElA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1693280425; x=1693885225; h=mime-version:user-agent:message-id:in-reply-to:date:references :subject:cc:to:from:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=7Ey6/lRvdJAQZBk+5/GdPtT1s5z9nb99Q6n/BiVAaRs=; b=WhQ7KOTGrhEK/IdFU+anygskBdw+/oATCrhAxO+nNpg9j2rTzs90wur9zgTOupwQDC hzCoxuzzEc/EhUoyJptB58da/a6UozjwUOm1wLW07ePy3X4mrvWWXG1LGFJT+x8iRqHX Qq9NWQHuCg+tlMCRwzmZooKEKeiJ+pcXUBRAzgH5Al0ISJIhAxJL4Wl0BhIlygnv3Kpx wsMFw02g28VUY4NO6mrIa0VehQqjwX/GXXJD4GxFaVj+j187p0BEA1VMYWQeEmx2/83K SR1MZVXqvcjOMdVU07RIO19gWxf+7aWJQhzR4dvsl2xM4kdF54ttwFE3OWtMzfdJeQLS bRjQ== X-Gm-Message-State: AOJu0Yyi38wewP0XcWhRlESfFq4lMp8cetME/PnDQ5MGszDtOiPUyDjf b6ATVNaxqlrfYHUDhZYTrF24j42PWk26SA== X-Google-Smtp-Source: AGHT+IEXNhzGfu+Avs7/liEOn5jiLVkYM7IQDCfFNGfvS6tGJCpHzgLJg2gNyXZtSV6dym0IVQda1Q== X-Received: by 2002:a05:620a:b50:b0:76f:da0:562d with SMTP id x16-20020a05620a0b5000b0076f0da0562dmr4671134qkg.69.1693280425128; Mon, 28 Aug 2023 20:40:25 -0700 (PDT) Received: from hurd (dsl-10-132-204.b2b2c.ca. [72.10.132.204]) by smtp.gmail.com with ESMTPSA id g8-20020a37e208000000b0076dbaf97b75sm2801224qki.108.2023.08.28.20.40.24 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 28 Aug 2023 20:40:24 -0700 (PDT) From: Maxim Cournoyer To: Mike Gerwitz Subject: Re: bug#32833: IceCat 60 certificate validation fails when using system NSS References: <87k1nadx4v.fsf@gnu.org> <87o9clck40.fsf@netris.org> <87a7o5cdv3.fsf@netris.org> <87tvmdcd6m.fsf@gnu.org> Date: Mon, 28 Aug 2023 23:40:23 -0400 In-Reply-To: <87tvmdcd6m.fsf@gnu.org> (Mike Gerwitz's message of "Tue, 25 Sep 2018 20:30:57 -0400") Message-ID: <874jkiect4.fsf_-_@gmail.com> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/28.2 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain X-Spam-Score: 0.0 (/) X-Debbugs-Envelope-To: 32833-done Cc: Mark H Weaver , 32833-done@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) Hello, Mike Gerwitz writes: > On Tue, Sep 25, 2018 at 20:16:16 -0400, Mark H Weaver wrote: >> Mark H Weaver writes: >>> To begin, I'm currently building IceCat using the bundled NSPR and NSS, >>> to see if that helps. >> >> Using the bundled NSPR and NSS works around the problem for me. I just >> pushed this change in commit 6d328879378fac95240005233331f596fb5c68ed on >> 'master'. See also the related, immediately preceding commits >> 257e3247910610fe24ae1b86f38e85552d53e48c and >> 94e96f7f68c3b9053fdb5dee5b0ab614163aaa08. > > Great! > >> I'm keeping this bug report open, since it would be good to find a >> better fix which avoids using the bundled libraries. > > I wish I knew enough to suggest a better solution. > > It's a little late now, but I just tested the IceCat binary on a Debian > machine and HTTPS works as expected. > > Thanks again for your work on this. Maybe I'll let IceCat build > overnight so I can give it a try tomorrow (still on my X200). I'm closing this issue, since we're now using the Guix provided nss and nspr packages for building IceCat since a while, and there doesn't appear to be an issue with doing so. -- Thanks, Maxim From unknown Wed Jun 18 00:24:31 2025 Received: (at fakecontrol) by fakecontrolmessage; To: internal_control@debbugs.gnu.org From: Debbugs Internal Request Subject: Internal Control Message-Id: bug archived. Date: Tue, 26 Sep 2023 11:24:06 +0000 User-Agent: Fakemail v42.6.9 # This is a fake control message. # # The action: # bug archived. thanks # This fakemail brought to you by your local debbugs # administrator