Kartikaya Gupta (email:kats@mozilla.staktrace.com) Reporter
	Description • 12 years ago

Load https://webmail.staktrace.com
Observe that this gives an "Untrusted connection" warning page with the following details:

webmail.staktrace.com uses an invalid security certificate.

The certificate is only valid for the following names:
  *.dreamhost.com , dreamhost.com  

(Error code: ssl_error_bad_cert_domain)

However, the warning page doesn't have a way to add the page as an exception and load the content anyway. i.e. the "I understand the risks" section is missing. This is NOT the case on some other "Untrusted connection" sites, such as https://people.mozilla.org/ for example - on that one there is an "I understand the risks" section that lets me get past it.

I can repro this on both release (16.0.2) and Aurora (18.0a2) which are what I have installed at the moment.

Note that this is different from bug 756841 because this is not being loaded into a frame, at least as far as I can tell. wget'ing the page with --no-check-certificate gets the page just fine as I would expect.

	Matthias Versen [:Matti]
	Comment 1 • 12 years ago

I can set an exception with Firefox 16.0.2 and Seamonkey trunk.

What you are seeing could be a result of a HSTS header that the site sent in the past. I checked with websniffer and https://webmail.staktrace.com/src/login.php doesn't send a HSTS header.

You can't override a security error if an HSTS header got set. The HSTS info is stored in your profile and you could try if a new profile makes a difference.
We have already a bug that a better error message is shown in case of a security error and active HSTS policy (bug 800882)

- http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security

	Kartikaya Gupta (email:kats@mozilla.staktrace.com) Reporter
	Comment 2 • 12 years ago

Ah, that makes sense. I do send an HSTS header from https://staktrace.com that applies to subdomains as well.

	Kartikaya Gupta (email:kats@mozilla.staktrace.com) Reporter
	Comment 3 • 12 years ago

I guess this is really just a dupe of 800882 then.