After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 728300 - Don't accept invalid certificates by default
Don't accept invalid certificates by default
Status: RESOLVED DUPLICATE of bug 708847
Product: epiphany
Classification: Core
Component: Passwords, Cookies, & Certificates
unspecified
Other Linux
: Normal normal
: ---
Assigned To: Epiphany Maintainers
Epiphany Maintainers
Depends on:
Blocks:
 
 
Reported: 2014-04-15 22:13 UTC by Karol Babioch
Modified: 2014-04-16 00:01 UTC
See Also:
GNOME target: ---
GNOME version: ---


Description Karol Babioch 2014-04-15 22:13:32 UTC 
Epiphany will happily establish connections with sites that offer an invalid certificate. Refer to [1] for an example of a site with a deliberately revoked certificate. Epiphany will also accept certificates that have no valid trust anchor.

In both of these cases an icon in the address bar indicates that something is not right, but most people will not be able to tell what is going on, making it easy to launch MiTM attacks.

Invalid certificates should *really* be ignored by default.

[1]: https://revoked.grc.com/
Comment 1 Michael Catanzaro 2014-04-15 23:53:08 UTC 
When I connect to that site, the lock icon does NOT indicate that anything is wrong (i.e. the situation for me is worse than you describe).  If you really do see a broken lock on that site, can you please attach a screenshot to Bug #728141, and also mention exactly what distro you are using. Thanks.

I'm going to close this as a duplicate of Bug #708847 (invalid certificates accepted by default), which is NOT Bug #728141 (certificate revocation).

*** This bug has been marked as a duplicate of bug 708847 ***
Comment 2 Karol Babioch 2014-04-16 00:01:27 UTC 
Well, I'm pretty sure that I saw an indication (broken lock) the first time I visited the page. However, I don't see it anymore, so I can't produce a screenshot.

Before I visited the site initially I had visited another site (with no known trust anchor), which definitely shows a broken lock symbol. Maybe there is some sort of caching glitch? Unfortunately I'm not able to reproduce the scenario, so we probably have to leave it at that for now.

Thanks for your effort of classification!