WSS Connections throw inaccurate errors
Reported by
d3c...@gmail.com,
Apr 11 2018
|
|||
Issue descriptionUserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36 Steps to reproduce the problem: https://gist.github.com/d3x0r/168b9fc4a74d3fcf425b15b009fdc844 This is a minimal self hosted server using node, and my system abstraction addon. it dynamically generates a valid cert chain with a root, a CA, and a cert. if the root was logged and installed as a root authority it would even be valid (until the program exited) it doesn't save the certs... There is a readme with the GIST; but I will rephrase it here. The gist creates a HTTPS server on port 8080 and port 8081 (ANYIP), A chrome browser connection to https://<IP>:8080/ will load the default 'index.html' included in the gist. The index.html opens two wss connections (in a sequence), first back to the original page origin, so that certificate is already accepted... (Hmm I did omit a part of the scenario, the original application did a connect from IPA to IPB which had a different certiciate, but that was created with a valid name, and that hop works too; although definitely certiciate_authority_invalid on that one too.. What is the expected behavior? The error for invalid certificate name should be shown instead of 'authoirty_invalid' since I've already allowed THAT sort of error.... What went wrong? Error is not really reported accuratly, and/or more information could be made available. Did this work before? N/A Does this work in other browsers? N/A Chrome version: 65.0.3325.181 Channel: stable OS Version: 10.0 Flash Version: Related : https://bugs.chromium.org/p/chromium/issues/detail?id=830001 I can't see what the certificates are to really see what the error is. If I've completely confused you; please inquire for more information. I don't know what the real policy of accepting invalid certificate authorities on the main page actually enables...
,
Apr 12 2018
,
Apr 13 2018
Is it only the second WebSocket connection that fails, or does the first one fail too> My understanding is that clicking through the warning on the main page only permits an invalid certificate for that specific host:port. Port 8081 is unaffected, and so will still fail. See https://bugs.chromium.org/p/chromium/issues/detail?id=825404, particularly comment #12 and below, for background. I haven't tried the sample code, but I noticed that |cert2| is created but not used.
,
Apr 13 2018
I see. Yes it appears it is host:port and not just host... I guess I had installed the root cert locally, and that's what fixed the 'ERR_CERT_AUTHORITY_INVALID', and showed invalid domain name thing; which if I was able to connect to it via https, I could accept that error also; but okay ya... My misdiagnosis. Should Won't Fix this.
,
Apr 13 2018
Thanks. |
|||
►
Sign in to add a comment |
|||
Comment 1 by krajshree@chromium.org
, Apr 12 2018