Looks like https://bugzilla.mozilla.org/show_bug.cgi?id=943937

However, the site mentioned there doesn't have the problem any more

CC: (none) => marja11
Version: 4 => Cauldron
See Also: (none) => https://bugzilla.mozilla.org/show_bug.cgi?id=943937
Whiteboard: (none) => MGA4TOO MGA3TOO

(In reply to Marja van Waes from comment #1)
> Looks like https://bugzilla.mozilla.org/show_bug.cgi?id=943937
> 
> However, the site mentioned there doesn't have the problem any more

Yes I confirm it still has the problem for me at this time but not with firefox 30 from Mozilla.

(In reply to andre salaun from comment #2)
> (In reply to Marja van Waes from comment #1)
> > Looks like https://bugzilla.mozilla.org/show_bug.cgi?id=943937
> > 
> > However, the site mentioned there doesn't have the problem any more
> 
> Yes I confirm it still has the problem for me at this time but not with
> firefox 30 from Mozilla.

you mean that with Mageia's Firefox this link
https://mailhost.icec.ti-edu.ch/Login.aspx?ReturnUrl=%2fdefault.aspx

doesn't give you the page with (at the bottom!) the "I understand the risks" -- "Add an exception" option? In the technical details I can see the error has changed there since the upstream bug report was filed, now it is "sec_error_ca_cert_invalid"

I wouldn't want us to just show a page without any error if there is something wrong with a certificate, but it would be nice to be able to add an exception for 
"sec_error_cert_not_in_name_space" pages, too.

Keywords: (none) => UPSTREAM
Summary: Firefox does not give UI access to cert when connection fails with namespace error => Firefox does not give UI access to cert when connection fails with "sec_error_cert_not_in_name_space" error

ouch, I'm waking up

FF can't give access to a certificate, if it isn't there at all.

Summary: Firefox does not give UI access to cert when connection fails with "sec_error_cert_not_in_name_space" error => Firefox does not give possibility to load a https page when there is a "sec_error_cert_not_in_name_space" error

(In reply to Marja van Waes from comment #4)
> ouch, I'm waking up
> 
> FF can't give access to a certificate, if it isn't there at all.

Yes it is.

The site mentionned in bugzilla.mozilla.org does not have problem any more.

But mine is different as you see.

However in this case Mageia's firefox is the only webbrowser to forbid acces. Others distributions (mentionned in description, and mint too) and "original" firefox from mozilla's site does not have.

I questionned discuss french list about this bug and they confirm, even under cauldron.

adding some FF committers to the CC of this report.

Akien confirmed that FF30 directly from upstream doesn't have a problem with that website, and that the certificate is present

Keywords: (none) => Triaged
CC: (none) => fundawang, luigiwalser

removing UPSTREAM because the upstream version doesn't have this issue (while our FF30 in cauldron does)

Keywords: UPSTREAM => (none)

Actually it is an upstream issue, but not with firefox.

It's the nss 3.16.0 -> 3.16.1 update that broke this

Keywords: (none) => UPSTREAM
CC: (none) => tmb
Source RPM: firefox => nss

(I hit return too fast)

... I confirmed this by rebuilding firefox against nss-3.16.0

Reported upstream

See Also: https://bugzilla.mozilla.org/show_bug.cgi?id=943937 => https://bugzilla.mozilla.org/show_bug.cgi?id=1028647

And reading 3.16.1 release notes I see:

- Imposed name constraints on the French government root CA ANSSI (DCISS).

wich points to:
https://hg.mozilla.org/projects/nss/rev/742307da0792

So it's a CA cert restriction for gouv.fr where the French gov CA now has signed a non gouv.fr site

See Also: (none) => https://bugzilla.mozilla.org/show_bug.cgi?id=952572

And here comes the fix...

Advisory:
Updated nss packages fixes accessing French goverment root CA signed websites

The nss 3.16.1 update done as part of MGASA-2014-0260 introduced a
regression because of the upstream change: 'Imposed name constraints on
the French government root CA ANSSI (DCISS)'
The change wont work as currenlty implemented as the French government
root CA signs more than 'gouv.fr' domains.

So for now we revert that change until its properly fixed upstream.

Mga3:
SRPM:
nss-3.16.1-1.1.mga3.src.rpm

i586:
libnss3-3.16.1-1.1.mga3.i586.rpm
libnss-devel-3.16.1-1.1.mga3.i586.rpm
libnss-static-devel-3.16.1-1.1.mga3.i586.rpm
nss-3.16.1-1.1.mga3.i586.rpm
nss-doc-3.16.1-1.1.mga3.noarch.rpm

x86_64:
lib64nss3-3.16.1-1.1.mga3.x86_64.rpm
lib64nss-devel-3.16.1-1.1.mga3.x86_64.rpm
lib64nss-static-devel-3.16.1-1.1.mga3.x86_64.rpm
nss-3.16.1-1.1.mga3.x86_64.rpm
nss-doc-3.16.1-1.1.mga3.noarch.rpm



Mga4:
nss-3.16.1-1.1.mga4.src.rpm

i586:
libnss3-3.16.1-1.1.mga4.i586.rpm
libnss-devel-3.16.1-1.1.mga4.i586.rpm
libnss-static-devel-3.16.1-1.1.mga4.i586.rpm
nss-3.16.1-1.1.mga4.i586.rpm
nss-doc-3.16.1-1.1.mga4.noarch.rpm

x86_64:
lib64nss3-3.16.1-1.1.mga4.x86_64.rpm
lib64nss-devel-3.16.1-1.1.mga4.x86_64.rpm
lib64nss-static-devel-3.16.1-1.1.mga4.x86_64.rpm
nss-3.16.1-1.1.mga4.x86_64.rpm
nss-doc-3.16.1-1.1.mga4.noarch.rpm

Cauldron:
fixed with nss-3.16.1-2.mga5



Simple testcase:

Before, try to access:
https://sacoche.ac-caen.fr/

and you get:

Error: sec_error_cert_not_in_name_space

then close firefox and update the nss packages.

After:
restart firefox and access:
https://sacoche.ac-caen.fr/

It should now work.

Assignee: bugsquad => qa-bugs

Fix confirmed on Cauldron x86_64.

CC: (none) => remi

As a an additional to the test procedure, you could also check for regression with: https://mailhost.icec.ti-edu.ch/Login.aspx?ReturnUrl=%2fdefault.aspx
This is supposed to be uncertified, so you should be offered to add an exception  (both before and after the update).

Tested Mageia 4 x86_64 in a VM, the update candidate fixes the issue and does not seem to introduce evident regressions.

Whiteboard: MGA4TOO, MGA3TOO => MGA4TOO, MGA3TOO MGA4-64-OK

Testing complete on Mageia 4 i586 on real hardware.

Whiteboard: MGA3TOO MGA4-64-OK => MGA3TOO MGA4-32-OK MGA4-64-OK

Complete on Mageia 3 i586 Mageia 3 x86_64 Ma

Oups ! complete on Mageia 4 x86_64

Testing complete mga3 32 & 64

https://sacoche.ac-caen.fr/
https://mailhost.icec.ti-edu.ch/Login.aspx?ReturnUrl=%2fdefault.aspx
https://cfspart.impots.gouv.fr/LoginAccess?op=c

and general https browsing

Validating. Advisory uploaded.

Could sysadmin please push to 3 & 4 updates

Thanks

Keywords: (none) => validated_update
Whiteboard: MGA3TOO mga3-32-ok mga3-64-ok MGA4-32-OK MGA4-64-OK => MGA3TOO advisory mga3-32-ok mga3-64-ok MGA4-32-OK MGA4-64-OK
CC: (none) => sysadmin-bugs

Update pushed:
http://advisories.mageia.org/MGAA-2014-0135.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED