OCSP error in icecat

OCSP error in icecat

[Andreas Enge]

Hello,

our icecat has problems with some tls sites, for instance:
   https://www.allistene.fr/

The error message is:
Secure Connection Failed
An error occurred during a connection to www.allistene.fr.
The OCSP server has refused this request as unauthorized.
(Error code: sec_error_ocsp_unauthorized_request)

The following site explains how to turn off OCSP verification:
   http://www.ghacks.net/2013/10/02/fix-ocsp-server-refused-request-unauthorized-firefox/

But maybe there is a preferable solution?

Andreas

Re: OCSP error in icecat

[Ludovic Courtès]

Andreas Enge <andreas@enge.fr> skribis:

> our icecat has problems with some tls sites, for instance:
>    https://www.allistene.fr/
>
> The error message is:
> Secure Connection Failed
> An error occurred during a connection to www.allistene.fr.
> The OCSP server has refused this request as unauthorized.
> (Error code: sec_error_ocsp_unauthorized_request)
>
> The following site explains how to turn off OCSP verification:
>    http://www.ghacks.net/2013/10/02/fix-ocsp-server-refused-request-unauthorized-firefox/
>
> But maybe there is a preferable solution?

Any idea why the OCSP server fails to reply in the first place?

Perhaps it’d be best to bring it on bug-gnuzilla@gnu.org?

Ludo’.

Re: OCSP error in icecat

[Andreas Enge]

On Wed, Apr 09, 2014 at 10:29:24PM +0200, Ludovic Courtès wrote:
> Perhaps it’d be best to bring it on bug-gnuzilla@gnu.org?

I started writing a bug report, but decided against sending it; I think the
problem is with the web server (the certificate of which has expired, by the
way).

> Andreas Enge <andreas@enge.fr> skribis:
> > The following site explains how to turn off OCSP verification:
> >    http://www.ghacks.net/2013/10/02/fix-ocsp-server-refused-request-unauthorized-firefox/

Well, "turn off" was too strongly worded here: When one unchecks
  Edit -> Preferences -> Advanced -> Certificates -> Validation
  -> "When an OCSP server connection fails, treat the certificate as invalid",
then the checks still work if the server replies. I think this is a reasonable
solution, but each user has to apply it individually.

Andreas

Re: OCSP error in icecat

[Ludovic Courtès]

Andreas Enge <andreas@enge.fr> skribis:

> On Wed, Apr 09, 2014 at 10:29:24PM +0200, Ludovic Courtès wrote:
>> Perhaps it’d be best to bring it on bug-gnuzilla@gnu.org?
>
> I started writing a bug report, but decided against sending it; I think the
> problem is with the web server (the certificate of which has expired, by the
> way).
>
>> Andreas Enge <andreas@enge.fr> skribis:
>> > The following site explains how to turn off OCSP verification:
>> >    http://www.ghacks.net/2013/10/02/fix-ocsp-server-refused-request-unauthorized-firefox/
>
> Well, "turn off" was too strongly worded here: When one unchecks
>   Edit -> Preferences -> Advanced -> Certificates -> Validation
>   -> "When an OCSP server connection fails, treat the certificate as invalid",
> then the checks still work if the server replies. I think this is a reasonable
> solution, but each user has to apply it individually.

So in the end, is there a real problem, or did it just have to do with a
specific web server?

Ludo’.

Re: OCSP error in icecat

[Andreas Enge]

On Sun, May 11, 2014 at 01:32:38PM +0200, Ludovic Courtès wrote:
> So in the end, is there a real problem, or did it just have to do with a
> specific web server?

It happens with various web servers (of which I have no other example right
now). But I do not think it is a bug or even a peculiarity of icecat. Just
the default setting is different in icecat than iceweasel (and, presumably,
firefox).

Andreas