WebSocket over TLS and Chained certificates
Reported by
yacine.p...@ingedata.net,
Dec 14 2016
|
|
Issue descriptionUserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.98 Safari/537.36 Steps to reproduce the problem: 1. At first you need to have a misconfigured server with certificates file without concatenation of chained authority, but with WebSocket support 2. Connect to the server through HTTPS. For some reason Chrome will not alert the end-user and the browsing will be possible even without the certificate chain present. 3. However, the handshake through wss:// will fail, giving no more informations than "Handshake Failure" What is the expected behavior? I guess the expected behavior would be to: A/ Reject both HTTPs and Websocket connections as they are unsafe B/ Accept both HTTPs and Websocket connections as they are safe enough Having only a part of the communication allowed seems really strange in my opinion What went wrong? The website seems to work properly, except for the websocket which fail to connect to the server. Did this work before? N/A Does this work in other browsers? Yes Chrome version: 54.0.2840.98 Channel: n/a OS Version: OS X 10.12.1 Flash Version: Shockwave Flash 24.0 r0
,
Dec 14 2016
Thank you for your prompt answer. I'll check later if I have time, to create a repeatable scenario with complete local setup.
,
Jan 7 2017
"Already fixed in subsequent Chrome versions" - why did you mark it won't fix if you're saying its "already fixed"? That makes no sense
,
Jan 8 2017
#3 - I imagine 2) of comment 1 corresponds to step 2 in the original report. |
|
►
Sign in to add a comment |
|
Comment 1 by rsleevi@chromium.org
, Dec 14 2016Status: WontFix (was: Unconfirmed)