After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 444844 - No sane error message when downloading from invalid certificate SSL connection
No sane error message when downloading from invalid certificate SSL connection
Status: RESOLVED WONTFIX
Product: epiphany
Classification: Core
Component: Downloads
2.18.x
Other All
: Normal normal
: ---
Assigned To: Epiphany Maintainers
Epiphany Maintainers
Depends on:
Blocks: 721283
 
 
Reported: 2007-06-06 18:55 UTC by Jérôme Guelfucci
Modified: 2016-02-28 05:47 UTC
See Also:
GNOME target: ---
GNOME version: 2.7/2.8



Description Jérôme Guelfucci 2007-06-06 18:55:30 UTC
Please describe the problem:
First reported on Launchpad : https://bugs.launchpad.net/ubuntu/+source/epiphany-browser/+bug/118974

by https://bugs.launchpad.net/~jelmer

Epiphany lists a download as "failed" in the downloads window without
any further indication why the download fails in the following
situation:

Downloading a file over a HTTPS connection, where the server does not
have a certificate that is signed by a CA trusted by the user.

Steps to reproduce:
1. Go to https://bioinformatics.chem.uu.nl/ and accept the certificate.
2. Right click on the Venncy link and select download



Actual results:
Download doesn't start and says "Failed"

Expected results:
User should be asked if he wants to download from an untrusted source, or a message should tell user that it won't download because of the certificate. It shouldn't just say "Failed"

Does this happen every time?
Yes

Other information:
Comment 1 Reinout van Schouwen 2007-06-17 18:04:50 UTC
Yes, I can reproduce this.
Comment 2 Reinout van Schouwen 2007-06-17 18:05:49 UTC
By the way, the download works correctly when you simply click the link.
Comment 3 Jérôme Guelfucci 2007-06-21 06:18:31 UTC
Exact, but it would be great if we also could right click.
Comment 4 William Jon McCann 2014-01-13 23:28:10 UTC
Anyone have an updated test case for this? The above link doesn't seem to work.
Comment 5 Michael Catanzaro 2016-02-28 05:47:53 UTC
(In reply to Jérôme Guelfucci from comment #0)
> Expected results:
> User should be asked if he wants to download from an untrusted source, or a
> message should tell user that it won't download because of the certificate.
> It shouldn't just say "Failed"

We silently fail all subresource loads with unacceptable TLS certificates, and so do all major browsers except Safari. I think failing downloads is good as well. Unacceptable TLS certificates are, nowadays, unacceptable, the site is broken, no reason the user should be prompted to think about such things.