GNU bug report logs - #32833
IceCat 60 certificate validation fails when using system NSS

Please note: This is a static page, with minimal formatting, updated once a day.
Click here to see this page with the latest information and nicer formatting.

Package: guix; Reported by: Mike Gerwitz <mtg@HIDDEN>; dated Tue, 25 Sep 2018 04:30:02 UTC; Maintainer for guix is bug-guix@HIDDEN.
Severity set to 'normal' from 'critical' Request was from Mark H Weaver <mhw@HIDDEN> to control <at> debbugs.gnu.org. Full text available.
Changed bug title to 'IceCat 60 certificate validation fails when using system NSS' from 'IceCat 60 showing sites as "insecure" despite using HTTPS' Request was from Mark H Weaver <mhw@HIDDEN> to control <at> debbugs.gnu.org. Full text available.

Message received at 32833 <at> debbugs.gnu.org:


Received: (at 32833) by debbugs.gnu.org; 26 Sep 2018 04:56:30 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Wed Sep 26 00:56:30 2018
Received: from localhost ([127.0.0.1]:54292 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1g51sC-0000If-6z
	for submit <at> debbugs.gnu.org; Wed, 26 Sep 2018 00:56:30 -0400
Received: from eggs.gnu.org ([208.118.235.92]:60977)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <mtg@HIDDEN>) id 1g51sA-0000IR-7O
 for 32833 <at> debbugs.gnu.org; Wed, 26 Sep 2018 00:56:26 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
 (envelope-from <mtg@HIDDEN>) id 1g51s1-0002D8-7N
 for 32833 <at> debbugs.gnu.org; Wed, 26 Sep 2018 00:56:18 -0400
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org
X-Spam-Level: 
X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00 autolearn=disabled
 version=3.3.2
Received: from fencepost.gnu.org ([2001:4830:134:3::e]:47137)
 by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from <mtg@HIDDEN>)
 id 1g51rz-0002B5-AZ; Wed, 26 Sep 2018 00:56:16 -0400
Received: from localhost ([::1]:55938 helo=mikegerwitz-pc.gerwitz.local)
 by fencepost.gnu.org with esmtps (TLS1.2:DHE_RSA_AES_128_CBC_SHA1:128)
 (Exim 4.82) (envelope-from <mtg@HIDDEN>)
 id 1g51rx-0006xg-5B; Wed, 26 Sep 2018 00:56:15 -0400
From: Mike Gerwitz <mtg@HIDDEN>
To: Mark H Weaver <mhw@HIDDEN>
Subject: Re: bug#32833: IceCat 60 showing sites as "insecure" despite using
 HTTPS
In-Reply-To: <87tvmdcd6m.fsf@HIDDEN> (Mike Gerwitz's message of "Tue, 25 Sep
 2018 20:30:57 -0400")
Date: Wed, 26 Sep 2018 00:55:07 -0400
Message-ID: <87bm8kdfis.fsf@HIDDEN>
References: <87k1nadx4v.fsf@HIDDEN> <87o9clck40.fsf@HIDDEN>
 <87a7o5cdv3.fsf@HIDDEN> <87tvmdcd6m.fsf@HIDDEN>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/25.3 (gnu/linux)
OpenPGP: id=22175B02E626BC98D7C0C2E5F22BB8158EE30EAB
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-=";
 micalg=pgp-sha512; protocol="application/pgp-signature"
X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic]
X-Received-From: 2001:4830:134:3::e
X-Spam-Score: -5.0 (-----)
X-Debbugs-Envelope-To: 32833
Cc: 32833 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -6.0 (------)

--=-=-=
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

On Tue, Sep 25, 2018 at 20:30:57 -0400, Mike Gerwitz wrote:
> Thanks again for your work on this.  Maybe I'll let IceCat build
> overnight so I can give it a try tomorrow (still on my X200).

LGTM.

=2D-=20
Mike Gerwitz

--=-=-=
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCgAGBQJbqxErAAoJEIyRe39dxRuiA0gQAJdJ1nmejq59J3DkKNuA9E5Z
gVrXi+GbU03JG64ZD5GFCViN9LNOTxrXX2/N+80TRysZTI01uzs8xsBLszT0gSKy
P4u1Apfrhlez0ny6YiRywXTNJo2oejh4/eUOLRpqMlf51F0Uleaygfo87Xs/dmwm
PLJRnpYTgvcb2ct+MbLjeWXsXTEJE+6pD8jtviXPpPSZgvT4+BkKL3O27h5rnMVc
4rq3oQxGGfwFd4bVNwF2nPp2nPfLPOpMQQVqcC/+ztfUmC2HR7YqCmeoOSBbQpAs
xzNnQiHiAdmtHqmNuOHKTqx9nHorrAPCFpUR/PmTEtub+M+HjHZEINptPXwWilaH
jnx/ItEuRBdEoCI0xW0F+8HsQie/h9Dprp1j9ZVbdJBld4zYaZvT5CnbjBlP4AQS
HK1HfjnkrtRU3yzOP4L8f93YJKYGN+LhoV58/MpFIcBBEX/vFHrD6vGJmDK1W0mY
KspcxZYZlKI4IT2ce+K1+duQGHrtb+QQYXaXXCtYl8gcXSNcr9GPfueGyihe47hu
zv75RMvy0O8mig4ZpEKSjQPwqlsdTEdR2FeS7BwNdZDsxCb4xbxPAqaKu98RRaOO
HJUXBv/B7d5HnC5gteDvVVZ3qA7QnQJBusrxXujv6IWVFQXD8mCN6B4mQvPxEazL
tbgLcoJvFu3u3kv1/y7+
=QsOk
-----END PGP SIGNATURE-----
--=-=-=--




Information forwarded to bug-guix@HIDDEN:
bug#32833; Package guix. Full text available.

Message received at 32833 <at> debbugs.gnu.org:


Received: (at 32833) by debbugs.gnu.org; 26 Sep 2018 00:34:17 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Tue Sep 25 20:34:17 2018
Received: from localhost ([127.0.0.1]:54231 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1g4xmT-00029u-C7
	for submit <at> debbugs.gnu.org; Tue, 25 Sep 2018 20:34:17 -0400
Received: from eggs.gnu.org ([208.118.235.92]:49280)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <mtg@HIDDEN>) id 1g4xmR-00029c-WA
 for 32833 <at> debbugs.gnu.org; Tue, 25 Sep 2018 20:34:16 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
 (envelope-from <mtg@HIDDEN>) id 1g4xmM-00012a-6a
 for 32833 <at> debbugs.gnu.org; Tue, 25 Sep 2018 20:34:10 -0400
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org
X-Spam-Level: 
X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00 autolearn=disabled
 version=3.3.2
Received: from fencepost.gnu.org ([2001:4830:134:3::e]:42748)
 by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from <mtg@HIDDEN>)
 id 1g4xmM-00012S-1n; Tue, 25 Sep 2018 20:34:10 -0400
Received: from localhost ([::1]:51551 helo=mikegerwitz-pc.gerwitz.local)
 by fencepost.gnu.org with esmtps (TLS1.2:DHE_RSA_AES_128_CBC_SHA1:128)
 (Exim 4.82) (envelope-from <mtg@HIDDEN>)
 id 1g4xmK-00085i-Kt; Tue, 25 Sep 2018 20:34:09 -0400
From: Mike Gerwitz <mtg@HIDDEN>
To: Mark H Weaver <mhw@HIDDEN>
Subject: Re: bug#32833: IceCat 60 showing sites as "insecure" despite using
 HTTPS
In-Reply-To: <87a7o5cdv3.fsf@HIDDEN> (Mark H. Weaver's message of "Tue, 25
 Sep 2018 20:16:16 -0400")
Date: Tue, 25 Sep 2018 20:30:57 -0400
Message-ID: <87tvmdcd6m.fsf@HIDDEN>
References: <87k1nadx4v.fsf@HIDDEN> <87o9clck40.fsf@HIDDEN>
 <87a7o5cdv3.fsf@HIDDEN>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/25.3 (gnu/linux)
OpenPGP: id=22175B02E626BC98D7C0C2E5F22BB8158EE30EAB
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-=";
 micalg=pgp-sha512; protocol="application/pgp-signature"
X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic]
X-Received-From: 2001:4830:134:3::e
X-Spam-Score: -5.0 (-----)
X-Debbugs-Envelope-To: 32833
Cc: 32833 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -6.0 (------)

--=-=-=
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

On Tue, Sep 25, 2018 at 20:16:16 -0400, Mark H Weaver wrote:
> Mark H Weaver <mhw@HIDDEN> writes:
>> To begin, I'm currently building IceCat using the bundled NSPR and NSS,
>> to see if that helps.
>
> Using the bundled NSPR and NSS works around the problem for me.  I just
> pushed this change in commit 6d328879378fac95240005233331f596fb5c68ed on
> 'master'.  See also the related, immediately preceding commits
> 257e3247910610fe24ae1b86f38e85552d53e48c and
> 94e96f7f68c3b9053fdb5dee5b0ab614163aaa08.

Great!

> I'm keeping this bug report open, since it would be good to find a
> better fix which avoids using the bundled libraries.

I wish I knew enough to suggest a better solution.

It's a little late now, but I just tested the IceCat binary on a Debian
machine and HTTPS works as expected.

Thanks again for your work on this.  Maybe I'll let IceCat build
overnight so I can give it a try tomorrow (still on my X200).

=2D-=20
Mike Gerwitz

--=-=-=
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCgAGBQJbqtNBAAoJEIyRe39dxRuiFqIQAIqBbCWEhiXsRYrh9XuQdRL3
YgkfjY73bmxdSHeb9WyX2buzdiZ0V7vZo2rR3lV+tAPmu72ZUF/KzrsgIxervJ3V
Sd6lnevtT8fZugP7BP+mgSocM0N+4mtUl0kH7wq4MOOGGc+S0TAlDq7ph2yWmQoA
hrUu/FrMkPGASSiGP8+TY6vU3ZfDCf6FeS86zLfUUy75LB5vytM90XntTDGl0P0H
jALgaZLRYHAuztcgQIAzmAGatWcIBZCAYH3s5ZBgI7A1usne20JXhOHmWugFL91X
fFJUn++pA9VV085MIfPwjTKZnehfWEK/bt5gFVJmJUiT1C76kosdvOrHBxmU17yz
YY/hLbdgX4nKNGsmleEiU3HAbsCs4HVJ0dIUYx5PAGM7S/ykv13s3xKthmh5Vc99
u25bDmWcx5lon81sMxjnOZZ5t6W5I1HzQlJw64q3B9pZAoyf55rX7wMKLtx+csHT
rE16d2BZVwWs9cGmROkdSrkHVt3w2jaJr6aDj27uOe9cZUkrP8XfClKru5r4zcLg
+16yz5C5AbkvRFzXojb/jmYllQRTVvYOJ8kz8RXWDxF5ixsjd6uAilvfWLxyuq00
AqTV+VRZ5yS1GWSsrErT0iC9CbH/BdqC9jYJMb0Gnass8Ggo41scS3iC2P7gU1Kx
iNzxT08dKcOBtrOTa/gh
=Rsuf
-----END PGP SIGNATURE-----
--=-=-=--




Information forwarded to bug-guix@HIDDEN:
bug#32833; Package guix. Full text available.

Message received at 32833 <at> debbugs.gnu.org:


Received: (at 32833) by debbugs.gnu.org; 26 Sep 2018 00:16:33 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Tue Sep 25 20:16:33 2018
Received: from localhost ([127.0.0.1]:54205 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1g4xVI-0001hP-PD
	for submit <at> debbugs.gnu.org; Tue, 25 Sep 2018 20:16:33 -0400
Received: from world.peace.net ([64.112.178.59]:42440)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <mhw@HIDDEN>) id 1g4xVH-0001hD-8H
 for 32833 <at> debbugs.gnu.org; Tue, 25 Sep 2018 20:16:31 -0400
Received: from mhw by world.peace.net with esmtpsa
 (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.89)
 (envelope-from <mhw@HIDDEN>)
 id 1g4xVB-0003gw-BO; Tue, 25 Sep 2018 20:16:25 -0400
From: Mark H Weaver <mhw@HIDDEN>
To: Mike Gerwitz <mtg@HIDDEN>
Subject: Re: bug#32833: IceCat 60 showing sites as "insecure" despite using
 HTTPS
References: <87k1nadx4v.fsf@HIDDEN> <87o9clck40.fsf@HIDDEN>
Date: Tue, 25 Sep 2018 20:16:16 -0400
In-Reply-To: <87o9clck40.fsf@HIDDEN> (Mark H. Weaver's message of "Tue, 25
 Sep 2018 18:01:19 -0400")
Message-ID: <87a7o5cdv3.fsf@HIDDEN>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.1 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 32833
Cc: 32833 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -1.0 (-)

Mark H Weaver <mhw@HIDDEN> writes:
> To begin, I'm currently building IceCat using the bundled NSPR and NSS,
> to see if that helps.

Using the bundled NSPR and NSS works around the problem for me.  I just
pushed this change in commit 6d328879378fac95240005233331f596fb5c68ed on
'master'.  See also the related, immediately preceding commits
257e3247910610fe24ae1b86f38e85552d53e48c and
94e96f7f68c3b9053fdb5dee5b0ab614163aaa08.

I'm keeping this bug report open, since it would be good to find a
better fix which avoids using the bundled libraries.

      Mark




Information forwarded to bug-guix@HIDDEN:
bug#32833; Package guix. Full text available.
Severity set to 'critical' from 'normal' Request was from Mark H Weaver <mhw@HIDDEN> to control <at> debbugs.gnu.org. Full text available.

Message received at 32833 <at> debbugs.gnu.org:


Received: (at 32833) by debbugs.gnu.org; 25 Sep 2018 22:01:37 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Tue Sep 25 18:01:37 2018
Received: from localhost ([127.0.0.1]:54134 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1g4vOj-0004eS-Ft
	for submit <at> debbugs.gnu.org; Tue, 25 Sep 2018 18:01:37 -0400
Received: from world.peace.net ([64.112.178.59]:42060)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <mhw@HIDDEN>)
 id 1g4vOg-0004e7-PP; Tue, 25 Sep 2018 18:01:35 -0400
Received: from mhw by world.peace.net with esmtpsa
 (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.89)
 (envelope-from <mhw@HIDDEN>)
 id 1g4vOZ-0002kQ-W6; Tue, 25 Sep 2018 18:01:28 -0400
From: Mark H Weaver <mhw@HIDDEN>
To: Mike Gerwitz <mtg@HIDDEN>
Subject: Re: bug#32833: IceCat 60 showing sites as "insecure" despite using
 HTTPS
References: <87k1nadx4v.fsf@HIDDEN>
Date: Tue, 25 Sep 2018 18:01:19 -0400
In-Reply-To: <87k1nadx4v.fsf@HIDDEN> (Mike Gerwitz's message of "Tue, 25 Sep
 2018 00:22:24 -0400")
Message-ID: <87o9clck40.fsf@HIDDEN>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.1 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 32833
Cc: 32833 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -1.0 (-)

severity 32833 critical
thanks

Hi Mike,

Mike Gerwitz <mtg@HIDDEN> writes:
> Even if sites are using HTTPS, IceCat is still saying "This connection
> is insecure" if you click on the "i" icon in the URL bar.  This seems to
> be a problem with every HTTPS site I visit.
>
> On the "Security" tab of the "Page Info" dialog, under "Technical
> Details", no certificate information is listed; it simply says
> "Connection Not Encrypted".  That's clearly not true, otherwise the page
> would fail to load.  I've tried with sites that use HSTS and don't even
> support plaintext connections (e.g. my own)---the pages load just fine.
>
> I haven't played around with sites with expired certificates or anything
> yet.  But if IceCat is not reporting security status correctly, then
> users may be at risk, so be careful in the meantime!

Thanks for reporting this.  I see the same problem, which is a surprise.
I would have expected some notification that something went wrong, but I
don't remember any.

Given the severity of this issue, we should prioritize deploying a
working fix ASAP, even if it's an ugly hack or workaround.

To begin, I'm currently building IceCat using the bundled NSPR and NSS,
to see if that helps.  If that fails, I'll look more closely at IceCat's
customizations to the default "about:config" settings.  The 'strace'
output might also have some clues.

I would welcome others to make their own efforts to find a fix for this
issue, or to share their ideas.

> I don't know if this is a problem specific to Guix or upstream; I can
> give IceCat a try in a Debian VM tomorrow.

Please do.  It would be _very_ helpful to know if this problem is
Guix-specific.

    Thanks,
      Mark




Information forwarded to bug-guix@HIDDEN:
bug#32833; Package guix. Full text available.

Message received at submit <at> debbugs.gnu.org:


Received: (at submit) by debbugs.gnu.org; 25 Sep 2018 04:29:45 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Tue Sep 25 00:29:45 2018
Received: from localhost ([127.0.0.1]:52713 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1g4eym-0004pe-VL
	for submit <at> debbugs.gnu.org; Tue, 25 Sep 2018 00:29:45 -0400
Received: from eggs.gnu.org ([208.118.235.92]:38571)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <mtg@HIDDEN>) id 1g4eyk-0004pP-Mf
 for submit <at> debbugs.gnu.org; Tue, 25 Sep 2018 00:29:43 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
 (envelope-from <mtg@HIDDEN>) id 1g4eye-0001Jm-Gs
 for submit <at> debbugs.gnu.org; Tue, 25 Sep 2018 00:29:37 -0400
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org
X-Spam-Level: 
X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00 autolearn=disabled
 version=3.3.2
Received: from lists.gnu.org ([2001:4830:134:3::11]:44718)
 by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32)
 (Exim 4.71) (envelope-from <mtg@HIDDEN>) id 1g4eyc-0001IV-8A
 for submit <at> debbugs.gnu.org; Tue, 25 Sep 2018 00:29:35 -0400
Received: from eggs.gnu.org ([2001:4830:134:3::10]:48032)
 by lists.gnu.org with esmtp (Exim 4.71) (envelope-from <mtg@HIDDEN>)
 id 1g4eyb-0001TP-DR
 for bug-guix@HIDDEN; Tue, 25 Sep 2018 00:29:34 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
 (envelope-from <mtg@HIDDEN>) id 1g4esL-00052y-Mo
 for bug-guix@HIDDEN; Tue, 25 Sep 2018 00:23:06 -0400
Received: from fencepost.gnu.org ([2001:4830:134:3::e]:49375)
 by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from <mtg@HIDDEN>)
 id 1g4esL-00052m-HC
 for bug-guix@HIDDEN; Tue, 25 Sep 2018 00:23:05 -0400
Received: from localhost ([::1]:58178 helo=mikegerwitz-pc.gerwitz.local)
 by fencepost.gnu.org with esmtps (TLS1.2:DHE_RSA_AES_128_CBC_SHA1:128)
 (Exim 4.82) (envelope-from <mtg@HIDDEN>) id 1g4esK-0001WR-BH
 for bug-guix@HIDDEN; Tue, 25 Sep 2018 00:23:05 -0400
From: Mike Gerwitz <mtg@HIDDEN>
To: bug-guix@HIDDEN
Subject: IceCat 60 showing sites as "insecure" despite using HTTPS
Date: Tue, 25 Sep 2018 00:22:24 -0400
Message-ID: <87k1nadx4v.fsf@HIDDEN>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/25.3 (gnu/linux)
OpenPGP: id=22175B02E626BC98D7C0C2E5F22BB8158EE30EAB
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-=";
 micalg=pgp-sha512; protocol="application/pgp-signature"
X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic]
X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6.x
X-Received-From: 2001:4830:134:3::11
X-Spam-Score: -5.0 (-----)
X-Debbugs-Envelope-To: submit
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -6.0 (------)

--=-=-=
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

I don't know if this is a problem specific to Guix or upstream; I can
give IceCat a try in a Debian VM tomorrow.  But I want to make others
aware of the problem in the meantime:

Even if sites are using HTTPS, IceCat is still saying "This connection
is insecure" if you click on the "i" icon in the URL bar.  This seems to
be a problem with every HTTPS site I visit.

On the "Security" tab of the "Page Info" dialog, under "Technical
Details", no certificate information is listed; it simply says
"Connection Not Encrypted".  That's clearly not true, otherwise the page
would fail to load.  I've tried with sites that use HSTS and don't even
support plaintext connections (e.g. my own)---the pages load just fine.

I haven't played around with sites with expired certificates or anything
yet.  But if IceCat is not reporting security status correctly, then
users may be at risk, so be careful in the meantime!

=2D-=20
Mike Gerwitz
Free Software Hacker+Activist | GNU Maintainer & Volunteer
GPG: D6E9 B930 028A 6C38 F43B  2388 FEF6 3574 5E6F 6D05
https://mikegerwitz.com

--=-=-=
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCgAGBQJbqbgAAAoJEIyRe39dxRuiUCAQAK7X0IkzrupMHKTepe8Hk6kk
oCQVWJPNaMcwEknghYFISg7LZJmP7AtlujzkTv85A4dvzeQKbMuOklQcJ3wbVmju
PdxNThdSHJ/jGsDHM/P3spberUP+rC8XtFqGFefGHLdF0//PaLXwncEK8ePvUpai
Y0EpyAiEl18B54sTNPijFA4jEXvNsaxnH87AdjcRLdb08M6DkShG6ND0VcAbdq8O
5HBkmr2USH/bJx7aatR3ItT9uMR4vaaCJ9j+6iMEltZAmWPVum8Jcj/AmKeNgBKf
t+tBQftuzW6N7kV5TGcY6J2ROaMp5TI32PQCYpmAyYY8vaDEb26PDZDaIZ4aDDtj
9Ay1aSjyrLQBLo002gKEvIkcnOQpoafHSc+BJAGbb3qZRn2QQ0oh99wOZWh9pRWv
jRI4Ts5DXBGMM/KPk2uNQvoworaZW11h3w2t8xAS3UqA0Z7xBt5idXBXK8M/NhUg
Qs2G8FTR6PyqF6LMhGlFjfHe21gsJ/aUf20RFw8lUdJWSG+Etpxqj4ayPpcmHfZh
1i/KZlfktAu4FLp/lqlqfdcVxJfVf1fL5M9WZ4zYlRCAh+SmZb7n/L7dbTPAzmOO
vQpaetoNjxpgzpP3cqHpibk9X9c1BYGDlvcWWRIO3YhZ1M4NiGe13//GMTaDFbgs
oxu8drjYbE/EltEfw4CA
=Iw+E
-----END PGP SIGNATURE-----
--=-=-=--




Acknowledgement sent to Mike Gerwitz <mtg@HIDDEN>:
New bug report received and forwarded. Copy sent to bug-guix@HIDDEN. Full text available.
Report forwarded to bug-guix@HIDDEN:
bug#32833; Package guix. Full text available.
Please note: This is a static page, with minimal formatting, updated once a day.
Click here to see this page with the latest information and nicer formatting.
Last modified: Wed, 26 Sep 2018 23:00:02 UTC

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997 nCipher Corporation Ltd, 1994-97 Ian Jackson.