Subject: Commitfest website certificate

From: Bruce Momjian <[email-masked]>
Date: Wed, 18 Apr 2012 13:30:42 -0400

I am seeing an error connecting to:

	https://commitfest.postgresql.org/

Firefox is saying:

	This Connection is Untrusted

	You have asked Firefox to connect securely to commitfest.postgresql.org,
	but we can't confirm that your connection is secure.
_
It started happening when I removed my Firefox preferences directory. 
Is this normal?  Does this site need an exception?

-- 
  Bruce Momjian  <[email-masked]>        http://momjian.us
  EnterpriseDB                             http://enterprisedb.com

  + It's impossible for everything to be true. +

---

From: Magnus Hagander <[email-masked]>
Date: Wed, 18 Apr 2012 19:34:49 +0200

> Is this normal?  Does this site need an exception?

It should not. Maybe someone is hacking your connection ;)

It should be running with the same certificate as e.g.
www.postgresql.org, which is a wildcard cert for *.postgresql.org
valid until 2016. sha-256 fingerprint is:
5D 19 8E 15 76 4F F4 0E 3E B0 0E B0 F4 2D 12 1B 93 CB 28 32 4D 39 5E
8B DB 47 3D 2A 1B E9 54 35

-- 
 Magnus Hagander
 Me: http://www.hagander.net/
 Work: http://www.redpill-linpro.com/

---

From: Bruce Momjian <[email-masked]>
Date: Wed, 18 Apr 2012 13:39:15 -0400

> 8B DB 47 3D 2A 1B E9 54 35

Well, though I am not home, I have seen this failure from two different
wireless networks.  Here are the technical details:

	Technical Details
        commitfest.postgresql.org uses an invalid security certificate.
	
	The certificate is not trusted because no issuer chain was provided.
	
	(Error code: sec_error_unknown_issuer)

This is with Firefox 11 on Ubuntu.  Does this help?

---

From: Stefan Kaltenbrunner <[email-masked]>
Date: Wed, 18 Apr 2012 19:49:08 +0200

> This is with Firefox 11 on Ubuntu.  Does this help?

Just to test a theory - do you get the same error if you connect to
https://meldrar.postgresql.org?

Stefan

---

From: Bruce Momjian <[email-masked]>
Date: Wed, 18 Apr 2012 13:52:27 -0400

> https://meldrar.postgresql.org?

Yes.  Technical details are the same too:

  Technical Details
          meldrar.postgresql.org uses an invalid security certificate.

---

From: Bruce Momjian <[email-masked]>
Date: Wed, 18 Apr 2012 13:58:32 -0400

>   (Error code: sec_error_unknown_issuer)

Here is someone having a similar error on Firefox 11:

	http://support.mozilla.org/en-US/questions/923163

---

From: Stefan Kaltenbrunner <[email-masked]>
Date: Wed, 18 Apr 2012 20:18:04 +0200

> 	http://support.mozilla.org/en-US/questions/923163

yeah if you are NOT getting the error on https://www.postgresql.org we
have identified the issue(it is affecting most of our ssl enabled sites
running lighttpd) as some sort of viral(...) copy&paste fail - will be
fixed soon...

Stefan

---

From: Bruce Momjian <[email-masked]>
Date: Wed, 18 Apr 2012 14:53:35 -0400

> have identified the issue(it is affecting most of our ssl enabled sites

I get no error for https://www.postgresql.org.

> running lighttpd) as some sort of viral(...) copy&paste fail - will be

Thanks.  You might be able to reproduce it by renaming ~/.mozilla to
another name, starting Firefox 11, and going to the problem URL.

---

From: Bruce Momjian <[email-masked]>
Date: Wed, 18 Apr 2012 14:54:02 -0400

> running lighttpd) as some sort of viral(...) copy&paste fail - will be

I can confirm that is now fixed!  Thanks.

---

From: Stefan Kaltenbrunner <[email-masked]>
Date: Wed, 18 Apr 2012 21:16:21 +0200

> I can confirm that is now fixed!  Thanks.

heh it was not actually fixed the moment you sent the mail, it "looked"
like it was fixed to you because your client probably cached the
intermediate certs the time you hit www.postgresql.org...

Stefan

---

From: Stefan Kaltenbrunner <[email-masked]>
Date: Wed, 18 Apr 2012 21:19:39 +0200

> another name, starting Firefox 11, and going to the problem URL.

much easier to test using something like:

openssl s_client -connect commitfest.postgresql.org:443

no need to cripple your FF install :)

Stefan

---

From: Bruce Momjian <[email-masked]>
Date: Wed, 18 Apr 2012 17:08:10 -0400

> intermediate certs the time you hit www.postgresql.org...

Oh, good point.