GNOME Bugzilla – Bug 703168
Certificate prompt lacks context
Last modified: 2019-11-12 16:52:24 UTC
I logged into a GNOME session and was presented with what's shown in the attached screenshot. The first thing I get, right in the centre of my screen when I log in, is a warning about a certificate. What certificate? What was it being used for? Was the system *trying* to talk to www.btopenzone.com, or is this a MITM attack? You are asking me if I should accept this cert for this particular purpose, or not. Which is a hard one to answer if you don't actually *tell* me what purpose you'd be using it *for*. There's a hint hidden right up in the top left-hand corner of the screen, where it says 'evolution-user-prompter'. But that's nowhere near good enough. I'm looking for the text in the dialog box to start with something along the lines of... When attempting to contact 'www.google.com' to fetch calendar data, the following certificate was presented by the server to assert its identity: (I'm guessing; I have no idea which server it was really trying to talk to.)
No attachment added, but anyway, this is bug #694322. (In reply to comment #0) > You are asking me if I should accept this cert for this particular purpose, or > not. Which is a hard one to answer if you don't actually *tell* me what purpose > you'd be using it *for*. I understand it's hard to answer, but I do not agree completely with the "purpose" part. Basically, if I'm trying to access the server through some ManInTheMiddle, then it doesn't matter why, the thing which matters is that the connection itself looks suspicious, regardless of what I'm going to do after I "successfully" log in. *** This bug has been marked as a duplicate of bug 694322 ***
(In reply to comment #1) > Basically, if I'm trying to access the server through some > ManInTheMiddle, then it doesn't matter why, the thing which matters is that the > connection itself looks suspicious, You say 'the server'. My point was that I have no idea *which* server you were trying to talk to. So I have no idea if the connection looks suspicious.
FWIW I'm not sure this *is* a duplicate. But 694322 was complaining about the fact that this dialog occurs at all (Hell, NM shouldn't be telling us we're online until we are actually online. We shouldn't have our connections getting stolen by the captive portal.) This bug was specifically for the fact that the message *within* the dialog box is unhelpful, on the occasions that it *does* happen.
If I open the bug #694322 comment #1 attachment, then the first line, the bold text (intentionally bold) in it shows the host name and then the account name as you have it configured in evolution. I expect that these two pieces of information, especially the first one with host name the backend tried to connect to, gives enough clue what server it is communicating to.
Mine didn't have that. http://david.woodhou.se/wtf-is-this-cert.png
Created attachment 249770 [details] screen shot (Just for a record.) Oh, how could that happen?
Reopening for the prove of breakage (screenshot).
My system clock was wrong. Evo objected to the fact that the certificate wasn't yet valid, before it spotted the fact that it was for a host *other* than the host it was actaully trying to reach.
Hmm, the screenshot (comment #6) doesn't make sense to me, because the code clearly adds at least: "Detailed information about the certificate:", but this is not part of your image. There is some whitespace gap at the top, possibly the two \n\n, thus maybe this is a translation issue? https://git.gnome.org/browse/evolution-data-server/tree/modules/trust-prompt/trust-prompt-gtk.c?h=gnome-3-8#n198
David, do you still see this with 3.12.x (the 3.12.11 is the latest stable currently). The upcoming 3.16.0 has the dialog done differently, as stated in the above-mentioned bug #694322. The text issue looks to me as a translation problem, or something odd in gtk, but the later is less likely, from my point of view.
Closing this bug report as no further information has been provided. Please feel free to reopen this bug report if you can provide the information that was asked for in a previous comment. Thanks!