all messages for Guix-related lists mirrored at yhetil.org
 help / color / mirror / code / Atom feed
* OCSP error in icecat
@ 2014-04-09 13:39 Andreas Enge
  2014-04-09 20:29 ` Ludovic Courtès
  0 siblings, 1 reply; 5+ messages in thread
From: Andreas Enge @ 2014-04-09 13:39 UTC (permalink / raw)
  To: guix-devel

Hello,

our icecat has problems with some tls sites, for instance:
   https://www.allistene.fr/

The error message is:
Secure Connection Failed
An error occurred during a connection to www.allistene.fr.
The OCSP server has refused this request as unauthorized.
(Error code: sec_error_ocsp_unauthorized_request)

The following site explains how to turn off OCSP verification:
   http://www.ghacks.net/2013/10/02/fix-ocsp-server-refused-request-unauthorized-firefox/

But maybe there is a preferable solution?

Andreas

^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: OCSP error in icecat
  2014-04-09 13:39 OCSP error in icecat Andreas Enge
@ 2014-04-09 20:29 ` Ludovic Courtès
  2014-05-11 10:20   ` Andreas Enge
  0 siblings, 1 reply; 5+ messages in thread
From: Ludovic Courtès @ 2014-04-09 20:29 UTC (permalink / raw)
  To: Andreas Enge; +Cc: guix-devel

Andreas Enge <andreas@enge.fr> skribis:

> our icecat has problems with some tls sites, for instance:
>    https://www.allistene.fr/
>
> The error message is:
> Secure Connection Failed
> An error occurred during a connection to www.allistene.fr.
> The OCSP server has refused this request as unauthorized.
> (Error code: sec_error_ocsp_unauthorized_request)
>
> The following site explains how to turn off OCSP verification:
>    http://www.ghacks.net/2013/10/02/fix-ocsp-server-refused-request-unauthorized-firefox/
>
> But maybe there is a preferable solution?

Any idea why the OCSP server fails to reply in the first place?

Perhaps it’d be best to bring it on bug-gnuzilla@gnu.org?

Ludo’.

^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: OCSP error in icecat
  2014-04-09 20:29 ` Ludovic Courtès
@ 2014-05-11 10:20   ` Andreas Enge
  2014-05-11 11:32     ` Ludovic Courtès
  0 siblings, 1 reply; 5+ messages in thread
From: Andreas Enge @ 2014-05-11 10:20 UTC (permalink / raw)
  To: Ludovic Courtès; +Cc: guix-devel

On Wed, Apr 09, 2014 at 10:29:24PM +0200, Ludovic Courtès wrote:
> Perhaps it’d be best to bring it on bug-gnuzilla@gnu.org?

I started writing a bug report, but decided against sending it; I think the
problem is with the web server (the certificate of which has expired, by the
way).

> Andreas Enge <andreas@enge.fr> skribis:
> > The following site explains how to turn off OCSP verification:
> >    http://www.ghacks.net/2013/10/02/fix-ocsp-server-refused-request-unauthorized-firefox/

Well, "turn off" was too strongly worded here: When one unchecks
  Edit -> Preferences -> Advanced -> Certificates -> Validation
  -> "When an OCSP server connection fails, treat the certificate as invalid",
then the checks still work if the server replies. I think this is a reasonable
solution, but each user has to apply it individually.

Andreas

^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: OCSP error in icecat
  2014-05-11 10:20   ` Andreas Enge
@ 2014-05-11 11:32     ` Ludovic Courtès
  2014-05-11 11:37       ` Andreas Enge
  0 siblings, 1 reply; 5+ messages in thread
From: Ludovic Courtès @ 2014-05-11 11:32 UTC (permalink / raw)
  To: Andreas Enge; +Cc: guix-devel

Andreas Enge <andreas@enge.fr> skribis:

> On Wed, Apr 09, 2014 at 10:29:24PM +0200, Ludovic Courtès wrote:
>> Perhaps it’d be best to bring it on bug-gnuzilla@gnu.org?
>
> I started writing a bug report, but decided against sending it; I think the
> problem is with the web server (the certificate of which has expired, by the
> way).
>
>> Andreas Enge <andreas@enge.fr> skribis:
>> > The following site explains how to turn off OCSP verification:
>> >    http://www.ghacks.net/2013/10/02/fix-ocsp-server-refused-request-unauthorized-firefox/
>
> Well, "turn off" was too strongly worded here: When one unchecks
>   Edit -> Preferences -> Advanced -> Certificates -> Validation
>   -> "When an OCSP server connection fails, treat the certificate as invalid",
> then the checks still work if the server replies. I think this is a reasonable
> solution, but each user has to apply it individually.

So in the end, is there a real problem, or did it just have to do with a
specific web server?

Ludo’.

^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: OCSP error in icecat
  2014-05-11 11:32     ` Ludovic Courtès
@ 2014-05-11 11:37       ` Andreas Enge
  0 siblings, 0 replies; 5+ messages in thread
From: Andreas Enge @ 2014-05-11 11:37 UTC (permalink / raw)
  To: Ludovic Courtès; +Cc: guix-devel

On Sun, May 11, 2014 at 01:32:38PM +0200, Ludovic Courtès wrote:
> So in the end, is there a real problem, or did it just have to do with a
> specific web server?

It happens with various web servers (of which I have no other example right
now). But I do not think it is a bug or even a peculiarity of icecat. Just
the default setting is different in icecat than iceweasel (and, presumably,
firefox).

Andreas

^ permalink raw reply	[flat|nested] 5+ messages in thread

end of thread, other threads:[~2014-05-11 11:37 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-04-09 13:39 OCSP error in icecat Andreas Enge
2014-04-09 20:29 ` Ludovic Courtès
2014-05-11 10:20   ` Andreas Enge
2014-05-11 11:32     ` Ludovic Courtès
2014-05-11 11:37       ` Andreas Enge

Code repositories for project(s) associated with this external index

	https://git.savannah.gnu.org/cgit/guix.git

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.