Re: [gentoo-user] broken seamonkey :(

[lee]

Fernando Rodriguez <frodriguez.developer@×××××××.com> writes:

> On Saturday, September 05, 2015 6:09:36 PM Mick wrote:
>> On Saturday 05 Sep 2015 14:06:27 lee wrote:
>> > Fernando Rodriguez <frodriguez.developer@×××××××.com> writes:
>> > > On Saturday, September 05, 2015 1:05:06 AM lee wrote:
>> > >> In this case, I happen to have full physical access to the server and
>> > >> thus to the certificate stored on it.  This is not the case for, let's
>> > >> say, an employee checking his work-email from home whom I might give
> the
>> > >> login-data on the phone and instruct to add an exception when the
> dialog
>> > >> to do so pops up when they are trying to connect.
>> > >
>> > > As a workaround you can create your own CA cert. I tested with a windows
>> > > self- signed cert (I guess the correct term is self-issued) and the
>> > > openssl command will show two certs. The second is the CA.
>> > >
>> > > http://datacenteroverlords.com/2012/03/01/creating-your-own-ssl-certifica
>> > > te-authority/
>> >
>> > They're saying:
>> >
>> >
>> > "Whatever you see in the address field in your browser when you go to
>> > your device must be what you put under common name, even if it’s an IP
>> > address.  [...]  If it doesn’t match, even a properly signed certificate
>> > will not validate correctly and you’ll get the “cannot verify
>> > authenticity” error."
>> >
>> >
>> > What's the solution for a server which can be reached by different fqdns
>> > and IPs?  What if the fqdns and IPs it can be reached by change over the
>> > lifetime of the certificates?
>>
> [...]
>
> Wildcards  should do it. The browser will give you a warning but you don't
> care since all you want is encryption and your users already trust you.

True --- and the problem will be back again when seamonkey etc. decide
not to accept certificates with wildcards anymore.

> The only thing that matters about that article is that you'll be signing your
> certificate with the CA ones so you get two certificates when you run the
> openssl command, the last one is the CA certificate. If you, or your users add
> trust to that one, anything you sign with it will be trusted.
>
> I only tried it with a windows server issued certificate which does all that by
> default.

Changing the key would be a last resort.

If I do that, should I use a SHA-3 key?  Would that work, or is SHA-3
too new?

> Since it lets you open the exception dialog but just hangs when downloading
> the certificate I wonder if it has something to do with your OCSP settings.
> Check that they match mine:
>
> security.OCSP.GET.enabled false
> security.OCSP.enabled 1
> security.OCSP.require false
>
> everything else is true.

I checked, and we have the same settings.  It doesn't really hang, it
does nothing when I try to get the certificate.  Does it do something
when you try?


-- 
Again we must be afraid of speaking of daemons for fear that daemons
might swallow us.  Finally, this fear has become reasonable.