unhelpful error message on SSL errors

Bug #1227055 reported by Jamie Strandboge on 2013-09-18
24
This bug affects 4 people
Affects Status Importance Assigned to Milestone
webbrowser-app
Fix Released
High
Adnane Belmadiaf
webbrowser-app (Ubuntu)
High
Olivier Tilloy
Saucy
High
Olivier Tilloy

Bug Description

Currently webbrowser-app shows the following on certificate errors:

"Network Error

It appears you are having trouble viewing: https://localhost:4443/.
Ubuntu suggests you check your network settings and try refreshing the page.

[Refresh page]"

Contrast that to chromium-browser's error:
"The site's security certificate is not trusted!

You attempted to reach localhost, but the server presented a certificate issued by an entity that is not trusted by your computer's operating system. This may mean that the server has generated its own security credentials, which Chromium cannot rely on for identity information, or an attacker may be trying to intercept your communications.
You should not proceed, especially if you have never seen this warning before for this site.

[Proceed anyway] [Back to safety]

+ Help me understand"

Firefox has similar functionality.

To fix this bug, only the error message needs to be adjusted. Ideally we might provide a better user experience with "Proceed anyway", but this should be discussed with the security team first since there are differing philosophies on ease of use of use vs "possible to proceed but difficult" as well as caching the result. If implementing this, you might be interested in:
http://developer.nokia.com/Community/Wiki/How_to_ignore_ssl_errors_to_get_https_website_work_on_QML_Webview

Basically, webbrowser-app would always default to honoring SSL verification, but if the user selected "Proceed anyway", then you would use onIgnoreSSLErrors for that site, for that tab/view, for that session.

Test case:
 1. untar the attached test-ca.tar.gz in /tmp
 2. start a server:
     $ /usr/bin/gnutls-serv --http -p 4443 --x509keyfile /tmp/test-ca/localhost-key.pem --x509certfile /tmp/test-ca/localhost.pem --x509cafile /tmp/test-ca/test-ca.pem
 3. point webbrowser-app at it:
     $ webbrowser-app https://localhost:4443/

Related branches

Jamie Strandboge (jdstrand) wrote :
Olivier Tilloy (osomon) on 2013-09-20
Changed in webbrowser-app (Ubuntu Saucy):
status: New → Confirmed
Olivier Tilloy (osomon) wrote :

It appears we need to provide a custom component for the experimental.certificateVerificationDialog property of the webview to deal with certificate verification.

The interface for this custom component exposes a "hostname" property, as well as two slots: "accept()" and "reject()".

Changed in webbrowser-app:
status: New → Confirmed
Olivier Tilloy (osomon) on 2013-09-20
Changed in webbrowser-app:
assignee: nobody → Adnane Belmadiaf (daker)
Bill Filler (bfiller) on 2013-09-20
Changed in webbrowser-app:
importance: Undecided → High
Changed in webbrowser-app (Ubuntu Saucy):
importance: Undecided → High
Olivier Tilloy (osomon) on 2013-09-21
Changed in webbrowser-app (Ubuntu Saucy):
assignee: nobody → Olivier Tilloy (osomon)
Adnane Belmadiaf (daker) on 2013-09-21
Changed in webbrowser-app:
status: Confirmed → In Progress
PS Jenkins bot (ps-jenkins) wrote :

Fix committed into lp:webbrowser-app at revision 330, scheduled for release in webbrowser-app, milestone ubuntu-13.04-month-5

Changed in webbrowser-app:
status: In Progress → Fix Committed
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package webbrowser-app - 0.22+13.10.20130924.1-0ubuntu1

---------------
webbrowser-app (0.22+13.10.20130924.1-0ubuntu1) saucy; urgency=low

  [ Ted Gould ]
  * Adding single instance marker to the desktop file.

  [ daker ]
  * Added support for Alert dialogs. (LP: #1169757)
  * Added support for HTTP/Proxy auth. (LP: #1212980)
  * Added certificateVerificationDialog component. (LP: #1227055)

  [ Adnane Belmadiaf ]
  * Added support for HTTP/Proxy auth. (LP: #1212980)
  * Added certificateVerificationDialog component. (LP: #1227055)

  [ Olivier Tilloy ]
  * Generate translation templates only for files under src/app/. Files
    under src/Ubuntu/… are the UbuntuWebView component, and they
    shouldn’t have any translatable strings.
  * Fix the selection rectangle size and position when zoomed and
    scrolled. (LP: #1131160)
  * Added support for HTTP/Proxy auth. (LP: #1212980)
  * Ensure the chrome is hidden when the permission request dialog is
    shown. (LP: #1226635)

  [ Ubuntu daily release ]
  * Automatic snapshot from revision 331
 -- Ubuntu daily release <email address hidden> Tue, 24 Sep 2013 07:05:03 +0000

Changed in webbrowser-app (Ubuntu Saucy):
status: Confirmed → Fix Released
Olivier Tilloy (osomon) on 2013-09-27
Changed in webbrowser-app:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Duplicates of this bug

Other bug subscribers

Bug attachments