search

moxie0 / Convergence

An agile, distributed, and secure alternative to the Certificate Authority system.
http://convergence.io
623 stars 127 forks source link

False positive? #95

Closed nbkuy closed 12 years ago

nbkuy commented 12 years ago

Hello, I suspect of an FP @ https://ketarin.org/forum/ that is blocked accordingly, can someone more knowleadgeble confirm? Thank you. BTW I'm using latest Convergence with FF 7.0.1, i've removed cert from cache but error is reproduced again. Neither FF or Chromium flag this cert as bad

ewanm89 commented 12 years ago

Duplicate of #28, looks like the server is using SNI.

nbkuy commented 12 years ago

This is very inconvenient, since I'm blocked, I need to disable Convergence OR change browser. Has a cert/domain whitelist been considered/requested?

ewanm89 commented 12 years ago

The problem isn't the actual verification, it's that when twisted visits the site (as happens with perspectives based convergence notaries) they see the site as a different domain, and so convergence generates a certificate for that other site.

moxie0 commented 12 years ago

@nbkuy There is an exception handler for Convergence failures, but unfortunately this isn't the case here. Everything is checking out correctly on the Convergence side of things, so this isn't a Convergence exception. The problem is that the certificate which is being received by both Convergence and the browser is valid for the names "forum.cdburnerxp.se" and "www.forum.cdburnerxp.se".

I'm going to close this as a duplicate of https://github.com/moxie0/Convergence/issues/28, and we can continue to talk about resolutions there.