User Agent: Mozilla/5.0 (X11; Linux i686 on x86_64; rv:38.0) Gecko/20100101 Firefox/38.0 Build ID: 20151027170520 Steps to reproduce: 1. Go to https://www.mozilla.org/en-US/thunderbird/all/ 2. Click English (US) download link for Thunderbird for Linux 64 bit, which points to https://download.mozilla.org/?product=thunderbird-38.4.0&os=linux64&lang=en-US 3. Actual download proceeded from via unprotected http URL instead of encrypted https: http://download.cdn.mozilla.net/pub/thunderbird/releases/38.4.0/linux-x86_64/en-US/thunderbird-38.4.0.tar.bz2 Actual results: Thunderbird had been downloaded, but it cannot be trusted because of possible modifications during download Expected results: The link https://download.mozilla.org/?product=thunderbird-38.4.0&os=linux64&lang=en-US and all other links on thunderbird download page should redirect to https:// urls

I believe these redirect are not handled by www.mozilla.org, so moving to the Bouncer component.

Looks like we need the -SSL suffix like Firefox to download the files via HTTPS: https://download.mozilla.org/?product=thunderbird-38.4.0-SSL&os=linux64&lang=en-US I don't know why HTTPS is not used by default though.

Let's get this fixed on www.mozilla.org side by simply adding 4 characters until the -SSL suffix will no longer be required.

Commits pushed to master at https://github.com/mozilla/bedrock https://github.com/mozilla/bedrock/commit/eee1f738b491cfe27b424e66f10a01be59806fc6 Fix Bug 1228502 - thunderbird download https changes to http https://github.com/mozilla/bedrock/commit/b199a9a9cee4ebcb4d7d0f457c7330a55c25721e Merge pull request #4001 from kyoshino/bug-1228502-thunderbird-ssl Fix Bug 1228502 - thunderbird download https changes to http