Implement TLS certificate management

[Michael Moroni]

I use my own CA (certficate authority) on my SSL-secured internal webservers. For this reason I wamt import my public CA Root certificate in midori, but midori has no import/export dialogs for certificates.

But: At the moment there is no warning dialog if a certificate is unknown (or selfsigned) in midori! This is a security bug, that need to be fixed first (there is a other bug report for this task).

Moved from FS: http://www.twotoasts.de/bugs/index.php?do=details&task_id=399

[Michael Moroni (airon90)]

Related bug http://www.twotoasts.de/bugs/index.php?do=details&task_id=168&project=2&pagenum=2

argafal

[Michael Moroni (airon90)]

Je confirme la nécessité de pouvoir gérer les certificats avec Midori :

- en France, la déclaration fiscale demande un certificat
- de plus en plus d'achats sur internet demandent également la gestion des certificats

Cette amélioration est plus que urgente. Je suis obligé d'installer Firefox pour pouvoir traiter ces tâches.
Si une solution n'est pas trouvée assez rapidement je serais donc contrain d'abandonner Midori, alors que je suis un fervent adepte.

Traduction Google :

I confirm the need to be able to manage the certificates with Midori

- In France, the "fiscal declaration" needs certificate
- More and more Internet purchases also require certificate management

This improvement is more than urgent.
I am forced to install Firefox to handle these tasks.
If a solution is not found quickly enough so I would be constraints to abandoning
Midori, as I am a firm believer.

pailou

[FR. Loïc (hackurx)]

Hi,

With my safety tests I just saw that midori does not monitor or poorly SSL Certificates ! (see the screenshot)

Midori is part of the Xfce project and is available in the repositories and varients therefore represents a consequent risk for the security.

[Cris Dywan (kalikiana)]

Coming here to say "I find this more urgent than anything else" is not helping very much, quite frankly. The above patches are the basis for using system certificates and displaying certificates. Anybody is free to pick it up and implement a way to open a dialog, perhaps by clicking the left-side icon or something else.

[Cris Dywan (kalikiana)]

http://stef.thewalter.net/2010/10/certificate-and-key-widgets.html
http://git.gnome.org/browse/libsoup/commit/?id=12238c7d3afd751b98fe3204092c254310bf1e69
http://opensource.conformal.com/cgi-bin/cvsweb/xxxterm/xxxterm/xxxterm.c?rev=HEAD

[Cris Dywan (kalikiana)]

Enhanced test case based on the above. Unfortunately, I'm unable to produce any output with libSoup API whatsoever.

[Cris Dywan (kalikiana)]

Updated GCR test patch, including inconsistency check, making use of the details dialog. No certificate output whatsoever on my system.

[Cris Dywan (kalikiana)]

WebKit apparently tends to send mock messages, by maintaining a hash table we get the certificate and flags. We then use it to render details with GCR, which you see on the screenshot. There's also a very simple fallback code path.

[Cris Dywan (kalikiana)]

Little update: unverifiable websites can also be trusted now by using the "Trust this website" button inside the error page.