search

moxie0 / Convergence

An agile, distributed, and secure alternative to the Certificate Authority system.
http://convergence.io
623 stars 127 forks source link

Can't override warning for site behind NAT wall #129

Open woozalia opened 12 years ago

woozalia commented 12 years ago

This is two problems that may actually be two separate issues, but I have no way to check if they occur independently.

Situation: Convergence is installed on machine A and is trying to access https://B:10000, which returns a self-signed certificate. Both A and B are on the same local network; B is not accessible from outside the network. A is running Firefox 8 with the Convergence extension installed.

Problem 1: Convergence incorrectly says that B is untrusted. This is understandable, since the notaries can't access it, but there should be a way to tell convergence "don't bother checking addresses in this range".

Problem 2: I click "I understand the risks", [Add Exception...], [Confirm Security Exception] -- and I am returned to the same warning screen. I cannot access the site. Disabling Convergence (without restarting Firefox) has no apparent effect.

moxie0 commented 12 years ago

You should see a convergence notification bar at the top of that warning page. Adding an exception through that mechanism should sort you out, unless your certificate's CN doesn't match the address you're typing?

woozalia commented 12 years ago

The only way I can override this warning is by turning off the plug-in and then shift-reloading the page. Here's the certificate as retrieved by Firefox (with Convergence disabled):

-----BEGIN CERTIFICATE----- MIICPTCCAeegAwIBAgIJANjvdupOOVUdMA0GCSqGSIb3DQEBBQUAMEsxIjAgBgNV BAoTGVdlYm1pbiBXZWJzZXJ2ZXIgb24gZXJuaWUxCjAIBgNVBAMUASoxGTAXBgkq hkiG9w0BCQEWCnJvb3RAZXJuaWUwHhcNMTEwNjI4MDIwNTA0WhcNMTYwNjI2MDIw NTA0WjBLMSIwIAYDVQQKExlXZWJtaW4gV2Vic2VydmVyIG9uIGVybmllMQowCAYD VQQDFAEqMRkwFwYJKoZIhvcNAQkBFgpyb290QGVybmllMFwwDQYJKoZIhvcNAQEB BQADSwAwSAJBAPJp7934nVHRLv5gFZ4gXkpcmzxwepzH/pMfHOsufeLJclGOVHAK x/j8jN7m7mckP0RPT4T/MvBX/L5Za3CAP+cCAwEAAaOBrTCBqjAdBgNVHQ4EFgQU mdLRQUsSpDW8oUAxd0z1GVQMU+0wewYDVR0jBHQwcoAUmdLRQUsSpDW8oUAxd0z1 GVQMU+2hT6RNMEsxIjAgBgNVBAoTGVdlYm1pbiBXZWJzZXJ2ZXIgb24gZXJuaWUx CjAIBgNVBAMUASoxGTAXBgkqhkiG9w0BCQEWCnJvb3RAZXJuaWWCCQDY73bqTjlV HTAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA0EAQD9ITKfgEjEF8KoiaoRA rL7/jKt4JCj2WCkB6czOvWLPvpfitUPBp9Y/ly5JDu5ATZq4AiP9/yqCiTnizIXY 5A== -----END CERTIFICATE-----

I just discovered today that I also have the same problem with this internet site (it's the control panel for a dedicated server): https://208.109.190.215:9999/ -- hopefully you can reproduce this one.

woozalia commented 12 years ago

I've found the same issue on an external site, which shows that the problem is actually not the firewall. This site -- https://office.sageandswift.com:10000/ -- gives the same error, and I have to turn off Convergence to get access at all.

Maybe it's the nonstandard port?

Jonny007-MKD commented 12 years ago

I get this error when I try to log in to an Telekom Hotspot which also serves a certificate which can't be evaluated because the internet connection isn't established yet. I also can't add an exception and have to disable the plugin then.