Date: Tue, 17 Nov 2015 21:07:02 -0500 From: "Michael B. Eichorn" <ike@michaeleichorn.com> To: Royce Williams <royce@tycho.org>, Zaphod Beeblebrox <zbeeble@gmail.com> Cc: FreeBSD Hackers <freebsd-hackers@freebsd.org> Subject: Re: FreeBSD forum certificates wrong somehow. Message-ID: <1447812422.23778.17.camel@michaeleichorn.com> In-Reply-To: <CA%2BE3k92UUHnt4wwCWkRY%2B2Ux_HWXzPfgKmHT6p6OF54RhzO3aA@mail.gmail.com> References: <CACpH0MeBPA1wmZMEbxk2vZS567rZcNQy8z2PRT44_d0zz1R-nA@mail.gmail.com> <CA%2BE3k92UUHnt4wwCWkRY%2B2Ux_HWXzPfgKmHT6p6OF54RhzO3aA@mail.gmail.com>
index | next in thread | previous in thread | raw e-mail
[-- Attachment #1 --] On Tue, 2015-11-17 at 16:28 -0900, Royce Williams wrote: > On Tue, Nov 17, 2015 at 4:05 PM, Zaphod Beeblebrox <zbeeble@gmail.com > > wrote: > > I realize that I have no idea who is in the wrong --- the error is > > rather > > opaque, but please follow: > > > > One of google or https everywhere (or both) directs my google > > searches to > > https when forums.freebsd.org comes up. For some reason, I can't > > seem to > > add an exception, but https is generally good... The forum does not serve http, there is a 301 redirect to https. > > > > ... but firefox doesn't want to talk to https://forums.freebsd.org. > > So > > much so, in fact, it doesn't even provide the usual "add exception > > for > > https self-signed" ... it's just a dialog to report this nasty > > violation. > > > > ... now I realize that chrome seems to read the site just > > fine...but I > > maintain that I'd rather not use chrome ... and really someone > > needs to > > look at the problem... > > > > ... and since I don't know how to effectively complain to mozilla, > > I'm > > starting by posting here. > > Firefox on what platform? I'm unable to replicate here, on Windows 7 > or Linux (all I can reach at the moment). More importantly which version. TLSv1.1 and 1.2 were disabled by default until version 27 (Released 20140204)[1]. And a noted below the forum requires at least 1.1 > > Qualys SSL Labs comes up clean for both IPv4 and IPv6: > > https://www.ssllabs.com/ssltest/analyze.html?d=forums.freebsd.org&s=1 > 49.20.54.209&latest > > https://www.ssllabs.com/ssltest/analyze.html?d=forums.freebsd.org&s=2 > 001%3A4f8%3A3%3A36%3A0%3A0%3A0%3A209 > > Only unusual (not bad) thing that stands out from the results is that > TLS 1.0 is not supported, which most sites haven't had the guts to do > yet that I have seen. > > Do the forums have any load-balancing or DNS anycast stuff going on, > or is forums.freebsd.org always 149.20.54.209 regardless of network > standpoint? > > Firefox usually supplies an error code (of the form > "err_ssl_version_or_cipher_mismatch" or similar). Anything like that > showing up on your end? > > Royce [1] http://website-archive.mozilla.org/www.mozilla.org/firefox_releasen otes/en-US/firefox/27.0/releasenotes/ [-- Attachment #2 --] 0 *H 010 `He 0 *H 000]0 *H 01 0 UIL10U StartCom Ltd.1+0)U "Secure Digital Certificate Signing1806U/StartCom Class 1 Primary Intermediate Client CA0 150613202446Z 160614003550Z0H1 0 U ike@michaeleichorn.com1%0# *H ike@michaeleichorn.com0"0 *H 0 UՀ,k9D %Z|Y6J<rrK g;&|uNlUE9)V.[ט̊:qS](#v SYDz* CpugYݔ,v<`j(w aS#ڒ6n(K5'KVLåErv< J=[}W bLA%gޭnVb| I?M7D :$׃bM_T[,ƃ\ 00 U 0 0 U 0 U %0++0 U jj: γ+39啖0 U #0Sr풜\|~5NԸQ0!U 0ike@michaeleichorn.com0LU C0?0; +70*0.+"http://www.startssl.com/policy.pdf0+00' StartCom Certification Authority0This certificate was issued according to the Class 1 Validation requirements of the StartCom CA policy, reliance only for the intended purpose in compliance of the relying party obligations.06U /0-0+)'%http://crl.startssl.com/crtu1-crl.crl0+009+0-http://ocsp.startssl.com/sub/class1/client/ca0B+06http://aia.startssl.com/certs/sub.class1.client.ca.crt0#U 0http://www.startssl.com/0 *H x+ȐF}pw.X vF?rg P]EOp)L˻yA ;hi0u2]m [Sbp$_ gr Xm*YP3 #H>mKAǠt)HO|=@} 3ӝ'iO81> 03 v'h5U "H;ECZtpҗ4rWHu^6+i*kJL8shAV|5;?HMc\ j[j|+000]0 *H 01 0 UIL10U StartCom Ltd.1+0)U "Secure Digital Certificate Signing1806U/StartCom Class 1 Primary Intermediate Client CA0 150613202446Z 160614003550Z0H1 0 U ike@michaeleichorn.com1%0# *H ike@michaeleichorn.com0"0 *H 0 UՀ,k9D %Z|Y6J<rrK g;&|uNlUE9)V.[ט̊:qS](#v SYDz* CpugYݔ,v<`j(w aS#ڒ6n(K5'KVLåErv< J=[}W bLA%gޭnVb| I?M7D :$׃bM_T[,ƃ\ 00 U 0 0 U 0 U %0++0 U jj: γ+39啖0 U #0Sr풜\|~5NԸQ0!U 0ike@michaeleichorn.com0LU C0?0; +70*0.+"http://www.startssl.com/policy.pdf0+00' StartCom Certification Authority0This certificate was issued according to the Class 1 Validation requirements of the StartCom CA policy, reliance only for the intended purpose in compliance of the relying party obligations.06U /0-0+)'%http://crl.startssl.com/crtu1-crl.crl0+009+0-http://ocsp.startssl.com/sub/class1/client/ca0B+06http://aia.startssl.com/certs/sub.class1.client.ca.crt0#U 0http://www.startssl.com/0 *H x+ȐF}pw.X vF?rg P]EOp)L˻yA ;hi0u2]m [Sbp$_ gr Xm*YP3 #H>mKAǠt)HO|=@} 3ӝ'iO81> 03 v'h5U "H;ECZtpҗ4rWHu^6+i*kJL8shAV|5;?HMc\ j[j|+040 0 *H 0}1 0 UIL10U StartCom Ltd.1+0)U "Secure Digital Certificate Signing1)0'U StartCom Certification Authority0 071024210155Z 171024210155Z01 0 UIL10U StartCom Ltd.1+0)U "Secure Digital Certificate Signing1806U/StartCom Class 1 Primary Intermediate Client CA0"0 *H 0 -).2AUGo#G B|NDRpM-B=o -we5JQpa>O.#._<V [~**pz~3WG .ᘟMlr[<Ce6fqO"uxfWN#uicgkv$Lb%y`_{`xK'GN 00U 00U 0 U Sr풜\|~5NԸQ0 U #0N @[i04hCA0f+Z0X0'+0http://ocsp.startssl.com/ca0-+0!http://www.startssl.com/sfsca.crt0[U T0R0'%#!http://www.startssl.com/sfsca.crl0'%#!http://crl.startssl.com/sfsca.crl0U y0w0u +70f0.+"http://www.startssl.com/policy.pdf04+(http://www.startssl.com/intermediate.pdf0 *H }x,\c^ #wMq}>UK/^yX֏y frMIŲB61ymQҨݬZ0& ;@#13qۑ& ̢o 6r_;GO>*I( 74XS1r3)!LJy6Kotˆ# _wSr ;B ADp(fs 䰷6%.W0J3:bC<8t X1<Cn=t==wST~\wkBf|15zUP)(IjVB!OfI=bb\4-*em/нSJm7N[]'@ڽ D9Kr>R7/|o^I@ټ'Pa $ z9a'L)( I}vcH]۸D*W} m>Q|C.(,lQ10{001 0 UIL10U StartCom Ltd.1+0)U "Secure Digital Certificate Signing1806U/StartCom Class 1 Primary Intermediate Client CA]0 `He 0 *H 1 *H 0 *H 1 151118020702Z0/ *H 1" I-t8m{━zˉbw%H`*0 +71001 0 UIL10U StartCom Ltd.1+0)U "Secure Digital Certificate Signing1806U/StartCom Class 1 Primary Intermediate Client CA]0 *H 101 0 UIL10U StartCom Ltd.1+0)U "Secure Digital Certificate Signing1806U/StartCom Class 1 Primary Intermediate Client CA]0 *H ucD@fA&+ em?Jbç:{;*V@UM f<m(/{qz GZTIWY|o89s}fn HrެWת9C`?pL -x&J, y ipQhj һo;4Mtx ( @'\˒}д)Nv$G Y[/ ܓD0help
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?1447812422.23778.17.camel>