"Add Exception" button missing on SSL Error pages
Posted: 2015-12-15, 18:38
So this has been driving me nuts for the last few days. It seems in Pale Moon, as far as I can tell, the "I Understand the Risks" dropdown and "Add Exception" button is completely missing on SSL Error pages, at least those carrying the error of "ssl_error_bad_cert_domain". I've checked the problem domain in a recent copy of Seamonkey, and the corresponding bits are definitely showing up there, so this appears to be a Pale Moon-specific problem.
Furthermore, manually adding the exception via the Certificates dialog, Pale Moon is still refusing to allow me to access the site. And yes, I really want to go to this site. It's safe to do so, just the site admins are apparently lazy and are using wildcard SSL certificates that don't match the specific sub-domain. Seamonkey, on the otherhand, lets me go there just fine once I add the exception.
The problem domain in question is the mailing list archives for the uClibc project, located at:
https://lists.uclibc.org/pipermail/uclibc/
They're using a wildcard SSL certificate issued by the Oregon State University Open Source Lab (osuosl), so you get the expected mismatch of "lists.uclibc.org" != "*.osuosl.org". A similar problem happens on another uclibc.org subdomain, where they're apparently sharing an SSL certificate issued to *.buildroot.org, an associated open-source project that actually uses the uClibc package. I guess the uClibc maintainers just wanted SSL to work, and didn't bother to get the certificate part done right. So it's legit to visit that site, and I do know what I am doing, but I need to make the browser see things my way, somehow (and I'd rather not have to break out the tire iron to do so...).
As for why Pale Moon seems to be denying the exception, I think it's a bug, but I'm not going to rule out it being a pedantic security practice that has an associated about:config bit hiding somewhere. I did find this thread that forces the "Add Exception" button to appear (by setting browser.xul.error_pages.expert_bad_cert to true), but adding an exception that way has the same non-effect as adding it via the Certificates dialog. Something is preventing me from accessing SSL domains where an "ssl_error_bad_cert_domain" error gets raised.
I've attached two screenshots showing the differences:
Furthermore, manually adding the exception via the Certificates dialog, Pale Moon is still refusing to allow me to access the site. And yes, I really want to go to this site. It's safe to do so, just the site admins are apparently lazy and are using wildcard SSL certificates that don't match the specific sub-domain. Seamonkey, on the otherhand, lets me go there just fine once I add the exception.
The problem domain in question is the mailing list archives for the uClibc project, located at:
https://lists.uclibc.org/pipermail/uclibc/
They're using a wildcard SSL certificate issued by the Oregon State University Open Source Lab (osuosl), so you get the expected mismatch of "lists.uclibc.org" != "*.osuosl.org". A similar problem happens on another uclibc.org subdomain, where they're apparently sharing an SSL certificate issued to *.buildroot.org, an associated open-source project that actually uses the uClibc package. I guess the uClibc maintainers just wanted SSL to work, and didn't bother to get the certificate part done right. So it's legit to visit that site, and I do know what I am doing, but I need to make the browser see things my way, somehow (and I'd rather not have to break out the tire iron to do so...).
As for why Pale Moon seems to be denying the exception, I think it's a bug, but I'm not going to rule out it being a pedantic security practice that has an associated about:config bit hiding somewhere. I did find this thread that forces the "Add Exception" button to appear (by setting browser.xul.error_pages.expert_bad_cert to true), but adding an exception that way has the same non-effect as adding it via the Certificates dialog. Something is preventing me from accessing SSL domains where an "ssl_error_bad_cert_domain" error gets raised.
I've attached two screenshots showing the differences:
- Palemoon ssl_error_bad_cert_domain
- Seamonkey ssl_error_bad_cert_domain