Re: Certificate exception for github.com not working with built-in root CAs removed

David Keeler <[email protected]> Tue, 8 Sep 2015 13:56:23 -0700

Newsgroups	gmane.comp.mozilla.security
Message-ID	<[email protected]>

HSTS is most likely the issue. If the browser notes a site as HSTS and
later encounters an error when attempting to verify the site's
certificate (such as not being able to find a trusted issuer), the spec
mandates that the connection not be allowed. See
https://tools.ietf.org/html/rfc6797#section-12.1

Cheers,
David

On 09/08/2015 01:46 PM, [email protected] wrote:
> Hello everybody,
> 
> I'm seeing following issue on current releases of both, Firefox and
> Thunderbird: If one removes all built-in root CAs in the Certificate
> Manager and adds a server exception for github.com, no connection is
> possible (Error code: sec_error_unknown_issuer).
> 
> While other servers, e.g., www.joomla.org, www.auswaertiges-amt.de can
> be connected to without problems. What can be seen on
> https://www.ssllabs.com/ssltest/analyze.html?d=github.com is that it
> supports HSTS, while the two working above don't. Could there be an
> issue with that here?
> 
> Many more details on https://bugzilla.mozilla.org/show_bug.cgi?id=1202511
> 
> Best,
> 
> Joe
> _______________________________________________
> dev-security mailing list
> [email protected]
> https://lists.mozilla.org/listinfo/dev-security

_______________________________________________
dev-security mailing list
[email protected]
https://lists.mozilla.org/listinfo/dev-security

signature.asc (application/pgp-signature, 819 B)