GNU bug report logs - #32833
IceCat 60 certificate validation fails when using system NSS

Previous Next

Full log

Message #10 received at control <at> debbugs.gnu.org (full text, mbox):

From: Mark H Weaver <mhw <at> netris.org>
To: Mike Gerwitz <mtg <at> gnu.org>
Cc: 32833 <at> debbugs.gnu.org
Subject: Re: bug#32833: IceCat 60 showing sites as "insecure" despite using
 HTTPS
Date: Tue, 25 Sep 2018 18:01:19 -0400

severity 32833 critical
thanks

Hi Mike,

Mike Gerwitz <mtg <at> gnu.org> writes:
> Even if sites are using HTTPS, IceCat is still saying "This connection
> is insecure" if you click on the "i" icon in the URL bar.  This seems to
> be a problem with every HTTPS site I visit.
>
> On the "Security" tab of the "Page Info" dialog, under "Technical
> Details", no certificate information is listed; it simply says
> "Connection Not Encrypted".  That's clearly not true, otherwise the page
> would fail to load.  I've tried with sites that use HSTS and don't even
> support plaintext connections (e.g. my own)---the pages load just fine.
>
> I haven't played around with sites with expired certificates or anything
> yet.  But if IceCat is not reporting security status correctly, then
> users may be at risk, so be careful in the meantime!

Thanks for reporting this.  I see the same problem, which is a surprise.
I would have expected some notification that something went wrong, but I
don't remember any.

Given the severity of this issue, we should prioritize deploying a
working fix ASAP, even if it's an ugly hack or workaround.

To begin, I'm currently building IceCat using the bundled NSPR and NSS,
to see if that helps.  If that fails, I'll look more closely at IceCat's
customizations to the default "about:config" settings.  The 'strace'
output might also have some clues.

I would welcome others to make their own efforts to find a fix for this
issue, or to share their ideas.

> I don't know if this is a problem specific to Guix or upstream; I can
> give IceCat a try in a Debian VM tomorrow.

Please do.  It would be _very_ helpful to know if this problem is
Guix-specific.

    Thanks,
      Mark

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.