deploying to 1.0.2 to live environment fails in safari

[Richard Harding]

When you deploy to a live environment and attempt to load the page in safari you get a ton of errors in the console and the GUI never moves past the 'connecting to environment'.

This revolves around the ssl warning that safari presents. Even if you continue, there's an issue and safari will not allow the web socket connection.

If you instead click on the "show certificiate" link during the safari warning, you have a checkbox for "always trust juju.ubuntu.com" and if you check that box and THEN continue, everything works.

We need to see what's the connection with juju.ubuntu.com and how to enable a more seamless safari experience.

This might need to be around the self signed cert generation in the charm. Marking this bug on both ends until it's diagnosed.

[Jay R. Wren (evarlast)]

Mavricks got rid of that checkbox, so these directions have to be followed for a workaround: http://support.apple.com/kb/PH14003

[Jay R. Wren (evarlast)]

Great, now the "always trust" checkbox IS in my safari, and it does work.

I examined the self signed cert, and it really is self signed. I don't think there is much more we can do. This is no different than the "Privacy error/Your connection is not private" message in chrome.

About the only change I can think of which might make things less confusing is changing the CN of the certificate from juju.ubuntu.com to something like "your-jujugui.local" to avoid the confusion of the juju.ubuntu.com host.

[Jay R. Wren (evarlast)]

http://curl.haxx.se/mail/archive-2013-10/0036.html has some background on chrome interaction. I'm seeing this behavior in chrome on OSX when I have not yet trusted the certificate via Safari/Keychain Access.

chrome console reports
GET https://192.168.15.101:2443/juju-ui/assets/sprites.css net::ERR_INSECURE_RESPONSE
for many things.

[Richard Harding (rharding)]

Thanks for the research Jay. I think that makes sense to remove the juju.ubuntu.com to something from the host.

We should also file a bug on the Juju GUI. The GUI can try to help out by providing instructions on the loading page if it's unable to connect and knows it's on safari. Hopefully that will help users help themselves to find the very hidden buttons.

The other thing we can look at suggesting is that users use a non-ssl connection, which is an option on the charm.

[Jay R. Wren (evarlast)]

Learning how safari works here...

If you click continue, that first time, without clicking Show Certificate, things fail, and the work around is one of two things:

1. Restart safari and this time click Show Certificate and check the Always trust checkbox

or

2. Follow the directions for importing to Keychain http://support.apple.com/kb/PH14003

[Jay R. Wren (evarlast)]

GUI notification moved to this bug: https://bugs.launchpad.net/juju-gui/+bug/1339155

CN renamed to avoid confusion and committed rev94: https://bazaar.launchpad.net/+branch/charms/juju-gui/revision/94