New issue
Advanced search Search tips

Issue 831862 link

Starred by 1 user

Issue metadata

Status: WontFix
Owner: ----
Closed: Apr 2018
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 2
Type: Bug



Sign in to add a comment

WSS Connections throw inaccurate errors

Reported by d3c...@gmail.com, Apr 11 2018

Issue description

UserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36

Steps to reproduce the problem:
https://gist.github.com/d3x0r/168b9fc4a74d3fcf425b15b009fdc844

This is a minimal self hosted server using node, and my system abstraction addon.

it dynamically generates a valid cert chain with a root, a CA, and a cert.  if the root was logged and installed as a root authority it would even be valid (until the program exited) it doesn't save the certs... 

There is a readme with the GIST; but I will rephrase it here.

The gist creates a HTTPS server on port 8080 and port 8081 (ANYIP), A chrome browser connection to https://<IP>:8080/  will load the default 'index.html' included in the gist.  The index.html opens two wss connections (in a sequence), first back to the original page origin, so that certificate is already accepted... 

(Hmm I did omit a part of the scenario, the original application did a connect from IPA to IPB which had a different certiciate, but that was created with a valid name, and that hop works too; although definitely certiciate_authority_invalid on that one too.. 

What is the expected behavior?
The error for invalid certificate name should be shown instead of 'authoirty_invalid' since I've already allowed THAT sort of error.... 

What went wrong?
Error is not really reported accuratly, and/or more information could be made available.

Did this work before? N/A 

Does this work in other browsers? N/A

Chrome version: 65.0.3325.181  Channel: stable
OS Version: 10.0
Flash Version: 

Related : https://bugs.chromium.org/p/chromium/issues/detail?id=830001 
I can't see what the certificates are to really see what the error is.

If I've completely confused you; please inquire for more information.  I don't know what the real policy of accepting invalid certificate authorities on the main page actually enables...
 
Labels: Needs-Triage-M65
Components: Internals>Network>Certificate Blink>Network>WebSockets

Comment 3 by ricea@chromium.org, Apr 13 2018

Is it only the second WebSocket connection that fails, or does the first one fail too>

My understanding is that clicking through the warning on the main page only permits an invalid certificate for that specific host:port. Port 8081 is unaffected, and so will still fail.

See https://bugs.chromium.org/p/chromium/issues/detail?id=825404, particularly comment #12 and below, for background.

I haven't tried the sample code, but I noticed that |cert2| is created but not used.

Comment 4 by d3c...@gmail.com, Apr 13 2018

I see.
Yes it appears it is host:port and not just host... 
I guess I had installed the root cert locally, and that's what fixed the 'ERR_CERT_AUTHORITY_INVALID', and showed invalid domain name thing; which if I was able to connect to it via https, I could accept that error also; but okay ya... 

My misdiagnosis.  Should Won't Fix this.

Comment 5 by ricea@chromium.org, Apr 13 2018

Status: WontFix (was: Unconfirmed)
Thanks.

Sign in to add a comment