thomas Reporter
	Description • 13 years ago

sub.example.com is a domain hosted on WHM/cPanel. cPanel provides a control panel accessed via https://sub.domain.com:2083 with a self-signed certificate.

sub.domain.com also has a valid SSL certificate from a CA recognized by Firefox.

Using Firefox, user visits https://sub.domain.com:2083 and accesses cPanel after usual certificate warning, adding exception, permanently storing and confirming the exception. 

This works as long as user does not visit the actual site https://sub.domain.com. Once the domain itself is visited https://sub.domain.com:2083 does not work anymore and access to cPanel control panel is not possible. The usual certificate warning is given, but "Confirm exception" button does not do anything.

These are the steps followed to repeat the problem
1- Create a new profile, no add-ons
2- Visit https://sub.domain.com:2083 (cPanel, cert warning)
3- Add exception
4- Confirm exception, permanently store
5- cPanel control panel is displayed
6- Visit https://sub.domain.com (actual site with valid SSL cert)
7- Repeat steps 2-4, "Confirm exception" does nothing, staying in "This Connection is Untrusted" page
9- Remove stored exceptions from "Options...> Servers and Authorities
10- Delete cert8.db and cert_override.txt in the profile
11- Restart and try step 7, with the same result.

This does not happen in Internet Explorer 8,9 or Chrome 13,14

	u279076
	Comment 1 • 13 years ago

Can you provide a minimized testcase or URL which reproduces this bug?

	u279076
	Comment 2 • 13 years ago

Also, is the certification self-signed? If so, this is likely a duplicate of bug 552976.

	thomas Reporter
	Comment 3 • 13 years ago

It turns out that this is due to caching by a downstream proxy.

	thomas Reporter
	Comment 4 • 13 years ago

oops, no. after access to actual domain, the problem is still there.

Here is the URL you can try.

1- Visit https://shop.baileyguitars.co.uk:2083 -> cert warning, perm. store and confirm exception. cPanel login page displays.
2- Visit https://shop.baileyguitars.co.uk
3- Try step 1 again. "Confirm exception"  button does not do anything

	u279076
	Comment 5 • 13 years ago

I just tried your steps in comment 4 in Firefox 8.0b1 and I cannot reproduce this bug.

1) Visit https://shop.baileyguitars.co.uk:2083 

Connection is Untrusted page because...
"The certificate is not trusted because it is self-signed"
"The certificate is only valid for vps.comptayr.co.uk"
"Error code: sec_error_untrusted_issuer"

2) "I Understand the Risks" > "Add Exception" > "Confirm Security Exception" and check "Permanently store this exception"

cPanel login page appears

3) Visit https://shop.baileyguitars.co.uk

Page loads with a BLUE site identity background displaying the following identity info:
"You are connected to baileyguitars.co.uk which is run by (unknown) Verified by Starfield Technologies Inc."

4) Click the BACK button

Popup notification displaying the same information in step 1.

5) Visit https://shop.baileyguitars.co.uk:2083 

Connection Untrusted page displays with the same information as step 1. However, this time the "I Understand the Risks" section is non-existent.

	u279076
	Comment 7 • 13 years ago

Thomas, would you kindly use our mozregression tool to see if this is a regression?

http://harthur.github.com/mozregression/

	Alice0775 White
	Comment 8 • 13 years ago

Tested with STR in comment#5.

Regression window(cached m-c hourly),
Works:
http://hg.mozilla.org/mozilla-central/rev/46f402c75824
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0b5pre) Gecko/20100824 Minefield/4.0b5pre ID:20100824084651
Fails:
http://hg.mozilla.org/mozilla-central/rev/a90640c20652
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0b5pre) Gecko/20100824 Minefield/4.0b5pre ID:20100824110352
Pushlog:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=46f402c75824&tochange=a90640c20652

Triggered By:
5dc3c2d2dd4f	Sid Stamm — Bug 495115 - Implement Strict-Transport-Security to allow sites to specify HTTPS-only connections, r=kaie+honzab+bjarne, a=betaN+

	Kai Engert (:KaiE:)
	Comment 9 • 13 years ago

This might be related to bug 660749, but it sounds sufficiently different to keep it as a separate bug.

	Dana Keeler (she/her) (use needinfo) (:keeler for reviews)
	Comment 10 • 8 years ago

Given comment 8 this is almost certainly bug 1092243.