Launchpad requests user certificate from Safari, MSIE/Windows, MSIE/Mac

[[GNU]]

When visited with some Web browsers, Launchpad asks for a user certificate.

This occurs with:
* Safari 2.0.3 (417.8)
<http://librarian.launchpad.net/1504774/launchpad.png>
- Launchpad is inaccessible as a result

* Internet Explorer 6 SP2
<http://librarian.launchpad.net/1547129/ie-cert-alert.png>
- "OK" loads the site

* Internet Explorer 5.2 for Mac
<http://librarian.launchpad.net/1557344/snap-001.png>
- Launchpad is inaccessible as a result

[Christian Reis (kiko)]

Doesn't this really sound like a Safari bug, if FF can access it fine? We don't require user certificates for launchpad.net -- are you visiting the homepage https://launchpad.net/?

[[GNU] (goern)]

Yes, I am accessing https://launchpad.net and maybe it could be rated as a misconfiguration of eiter Safari or launchpad.net Basically I can only describe what I was observing as I have no idea of the configuration of launchpad.net

[Matthew Paul Thomas (mpt)]

Launchpad works fine for me in Safari 1.3.1 without any certificates. GNU, please attach a screenshot of Safari asking you for a certificate.

[[GNU] (goern)]

I dont know the exact english message, my translation:

The website "launchpad" didn't accept the Certificate for Christoph Görn.

This website requires you to identify yourself by a Certificate. Choose the Cert that you want to use to identify yourself, click "Fortfahren" (continue).

Any of the Certs work either. Thanks for the support!

[James Henstridge (jamesh)]

There is a section of https://launchpad.net that requires a certificate (the /errors URL, which is now a 404 since the error reporting changes). I wonder if this could be the issue?

I haven't ever seen a dialog like that before.

[[GNU] (goern)]

James: That may be, but I was accessing / and /token URLs

[Brad Bollenbach (bradb)]

Launchpad works fine for me, using the same Safari version as [GNU].

[GNU], can you test this on a copy of Safari, ideally the same version, on another machine?

[[GNU] (goern)]

Brad, same thing from another Safari, so it seems to be a local configuration problem, which I have no idea why and what...

[Matthew Paul Thomas (mpt)]

A friend just sent me this screenshot, showing the same thing happening in Internet Explorer. She says that if she just clicks "OK" without selecting a certificate (she doesn't have any), the site loads as normal.

GNU, what does "Zertificat einblenden" mean, and have you tried clicking it? (It looks like it's in right part of the alert for a "Don't Use a Certificate" button.)

[Matthew Paul Thomas (mpt)]

The MSIE/Mac codebase is (was) completely different from that of MSIE/Windows, yet it puts up a similar alert.

I guess there's something not quite right with Launchpad's HTTPS.

[Maximilian Gerlach (def306)]

Just FYI, my Safari 2.03 refuses to load https://launchpad.net too. It tells me "client certificate rejected".
Pretty annoying to always have to open FF whenever I want to file (or view) a bug report when I'm in OS X.

[Brad Bollenbach (bradb)]

Bumping up the severity, because this is getting in the way of people using LP in some browsers.

[Diogo Matsubara (matsubara)]

Might be related to bug 30680

[Gustaf (opera)]

Applies to Opera 9 beta2 on Linux.
Every single page browsed on the launchpad.net site pops up a request for a certificate.

[Christina Zeeh (bugzilla-tuxtina-deactivatedaccount)]

I suspect this problem occurs when mod_ssl's SSLVerifyClient is set to anything other than none (even optional). Maybe the server admins could check the Apache configuration and, if active, set it to none if it's not necessary

The reason why it seems to be working for some Safari users is that they don't have a private key in any of their keychains. Once you have any kind of private key (.Mac, FileVault master key, ...) in any of your keychains, it fails miserably.

[Christian Reis (kiko)]

We believe this is now fixed; there is no longer any client certificate checking done on our servers. If this issue still occurs for you, please reopen.

[Sascha Silbe (sascha-ubuntu-launchpad)]

I can confirm it now works fine even when presenting a client certificate. Thanks!