[Bug-gnuzilla] Secure Connection Failed: authenticity of the received data could not be verified

[David Hedlund]

Affected icecat versions

Firefox	Error on https://cve.trust.telia.com/TeliaElegNG/	IceCat (built on Firefox ESR)	IceCat source	Error on https://cve.trust.telia.com/TeliaElegNG/	IceCat test reporter
Firefox ESR 38.5.2	None	IceCat 38.5.2	icecat_38.5.2-gnu1+7.0trisquel1_amd64.deb	“Secure Connection Failed”	David Hedlund <address@hidden>
Firefox ESR 38.5.0	None	IceCat 38.5.0	icecat_38.5.0-gnu1+7.0trisquel1_amd64.deb	“Secure Connection Failed”	David Hedlund <address@hidden>
Firefox ESR 38.4.0	Not tested	IceCat 38.4.0	compiled Icecat source code from Trisquel repository	None	Antonio Trande
Firefox ESR 38.3.0	Not tested	IceCat 38.3.0	package	“Secure Connection Failed”	Antonio Trande
Firefox ESR 31.2.0	Not tested	IceCat 31.2.0	31.2.0-1+7.0trisquel2	None	Narcis Garcia

Issues

Example 1

* https://cve.trust.telia.com/TeliaElegNG/ message:

"Secure Connection Failed

The connection to cve.trust.telia.com was interrupted while the page was loading.

    * The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
    * Please contact the website owners to inform them of this problem."

Example 2

* Cannot download Umeå Energi AB electronic billings from Swedbank internetbank.

Steps to reproduce: You need a Swedbank bank account to do this. Go to https://internetbank.swedbank.se/ ("Private" not "Company"), navigate to "Startsida -> Elektroniska dokument -> Umeå Energi AB -> Visa", this will open the page https://faktura.umeaenergi.se/ with message:

"Secure Connection Failed

The connection to faktura.umeaenergi.se was interrupted while the page was loading.

    * The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
    * Please contact the website owners to inform them of this problem."


#########################################

Troubleshooting (that didn't help)

* Followed Ruben's advice (https://www.mail-archive.com/address@hidden/msg02756.html): "That comes from disabling DHE as a countermeasure for logjam: pref("security.ssl3.dhe_rsa_des_ede3_sha", false); "
   1. set "security.ssl3.dhe_rsa_des_ede3_sha" to true in about:config
   2. Closed about:config
   3. Cleared the cache
   4. https://cve.trust.telia.com/TeliaElegNG/ still say "Secure Connection Failed""

  References:
  https://directory.fsf.org/wiki/Disable_DHE
  https://weakdh.org/

* Troubleshoot the "Secure Connection Failed" error message - https://support.mozilla.org/en-US/kb/secure-connection-failed-error-message
  1. Disable hardware acceleration
  2. Restart IceCat in a fresh profile, and restart the profile in Safe Mode.

* Edit -> Preferences -> Content -> [unckeck] Block pop-up windows


##############################################

Page source

* Saving the "Secure Connection Failed" page adds "Problem loading page.xhtml" attached in this email.
* View Page Source for "Secure Connection Failed" pages open a new page which says:

"The connection was interrupted

The connection to was interrupted while the page was loading.

    The site could be temporarily unavailable or too busy. Try again in a few moments.
    If you are unable to load any pages, check your computer's network connection.
    If your computer or network is protected by a firewall or proxy, make sure that IceCat is permitted to access the Web."

Upon investigation, I found out that there are two variants of the message "Secure Connection Failed". The one described in this email is "nssFailure2":

<!ENTITY nssFailure2.title "Secure Connection Failed">
<!ENTITY nssFailure2.longDesc2 "
<ul>
  <li>The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.</li>
  <li>Please contact the website owners to inform them of this problem.</li>
</ul>
">

Problem loading page.xhtml
Description: application/xhtml