If a certificate error is allowed, sub-resources are still blocked

[Chris Coulson]

If an application overrides a certificate error for a page, the page is loaded with sub-resources blocked if those subresource loads are affected by the same error with the same certificate. This behaviour is different to both Chromium and Firefox.

What's missing in Oxide is that we need to remember the application decision for a pre-determined amount of time, so that we can check this decision in our implementation of content::SSLHostStateDelegate.

[Olivier Tilloy (osomon)]

Concrete use-case: it’s been reported that users who set up their owncloud instance with a self-signed certificate cannot log in to it, because the log-in page loads jquery and other JS libs as subresources, which fails, and thus the page is broken. See bug #1523261.

[Laryllan (laryllan)]

Olivier,

will this bug be resolved in OTA-9?

[Olivier Tilloy (osomon)]

It won’t be resolved in OTA-9, the status of the bug is accurate, meaning that no-one has started working on it yet.

[icewater (a-ubuntu)]

I have experienced this as well, with owncloud; and I see similar behavior attempting to log into a tt-rss instance with a self-signed certificate.