untrusted certificates

442 views
Skip to first unread message

emjot

unread,
Jan 11, 2010, 9:25:49 AM1/11/10
to webdriver
Hi folks,

I know, this topic have already been discussed but no of the given
solutions works for me.
I am currently testing a website with an untrusted certificate using
webdriver. So I used my old Firefox Profile, I used previosly for
testing with selenium 1.0.1. In this profile, an security exception is
already added. But when I use webdriver, the security warning by
firefox comes again and again. If I use this profile to perform these
steps manually and create the security exception (witch should
alrready be createt in any case), and the webdriver plugin is enabled,
I can't get past this security screen. If I press the button "add
exeption" (or how it miegt be named in english version) and have
checked to save this exception for further use, the same screen
appears again (I mean the pages appeares immediately after adding the
exception and I'm not forwardet to the webpage with the unsecure
certificate, like firefox typically behaves). This makes me believe,
there's a bug in the webdriver extension?
If I disable the webdriver plugin in this profile, the exceptions is
noticed and the Firefox security screen behavior is as expected.
I used this test porvile by unsing ProfileInis.getProfile() and
alternativly tried to set the System property
"webdriver.firefox.profile".
I use Firefox 3.5.5 on Windows XP (german version both).

I hope anybody can help me, since webdirver is a convenient way to
test. :)

Regards,
Martin

Eran M.

unread,
Jan 11, 2010, 9:57:04 AM1/11/10
to webd...@googlegroups.com
Hi,

There is indeed an open issue about it which I plan to fix in the next couple of days - basically, WebDriver on Firefox should allow untrusted certificates but a bug in the implementation prevents it from doing so.

Eran

2010/1/11 emjot <TopfK...@web.de>
--
You received this message because you are subscribed to the Google Groups "webdriver" group.
To post to this group, send email to webd...@googlegroups.com.
To unsubscribe from this group, send email to webdriver+...@googlegroups.com.
For more options, visit this group at http://groups.google.com/group/webdriver?hl=en.




emjot

unread,
Jan 11, 2010, 11:30:33 AM1/11/10
to webdriver
Thanks for the quick reply,

I have found a solution for me.. :) I work around this issue by
setting up my firefoxprofile to not accept untrusted Certificates.
(FirefoxProfile.setAcceptUntrustedCertificates(false) ). It wasn't
obvious for me, that it prevents Webdriver from handeling the
certificate itselft. Now it works as
I used to do it with selenium. Manually accepting this exception and
everythig works fine. :)

Martin

On 11 Jan., 15:57, "Eran M." <eran....@gmail.com> wrote:
> Hi,
>
> There is indeed an open issue about it which I plan to fix in the next
> couple of days - basically, WebDriver on Firefox should allow untrusted
> certificates but a bug in the implementation prevents it from doing so.

> See Issue 116 <http://code.google.com/p/webdriver/issues/detail?id=116>.
>
> Eran
>
> 2010/1/11 emjot <TopfKop...@web.de>

> > webdriver+...@googlegroups.com<webdriver%2Bunsu...@googlegroups.com>

Eran M.

unread,
Jan 13, 2010, 12:59:46 PM1/13/10
to webd...@googlegroups.com
Hi,

This work-around should not be needed anymore - I've committed a fix in r8070. I'll appreciate it if you could try your tests again with these changes.

Cheers,
Eran

2010/1/11 emjot <TopfK...@web.de>
To unsubscribe from this group, send email to webdriver+...@googlegroups.com.

PerfectStorm

unread,
Mar 12, 2010, 10:41:12 AM3/12/10
to webdriver
Eran

I am still seeing the issue the following are the two errors I see in
the error console

Error: Attempted to connect to a site with a bad certificate in the
add exception dialog. This results in a (mostly harmless) exception
being thrown. Logged for information purposes only: [Exception...
"Component returned failure code: 0x80004005 (NS_ERROR_FAILURE)
[nsIXMLHttpRequest.send]" nsresult: "0x80004005 (NS_ERROR_FAILURE)"
location: "JS frame :: chrome://pippki/content/exceptionDialog.js ::
checkCert :: line 167" data: no]
Source File: chrome://pippki/content/exceptionDialog.js
Line: 175

Error: DomMessenger is not defined
Source File: chrome://fxdriver/content/server.js
Line: 36

Warning: Failed to load overlay from chrome://starter/content/starterScript.xul.
Source File: chrome://browser/content/browser.xul
Line: 0

I have the following messages -
Spoofing prompt service
Found preference for webdriver_accept_untrusted_certs: true
Found preference for webdriver_assume_untrusted_issuer: true
Accept untrusted certificates: true
Enable native events: true


On Jan 13, 12:59 pm, "Eran M." <eran....@gmail.com> wrote:
> Hi,
>

> This work-around should not be needed anymore - I've committed a fix in
> r8070. I'll appreciate it if you could try your tests again with these
> changes.
>
> Cheers,
> Eran
>

> 2010/1/11 emjot <TopfKop...@web.de>

> > > > webdriver+...@googlegroups.com<webdriver%2Bunsubscribe@googlegroups­.com>
> > <webdriver%2Bunsu...@googlegroups.com<webdriver%252Bunsubscribe@googleg­roups.com>


>
> > > > .
> > > > For more options, visit this group at
> > > >http://groups.google.com/group/webdriver?hl=en.
>
> > --
> > You received this message because you are subscribed to the Google Groups
> > "webdriver" group.
> > To post to this group, send email to webd...@googlegroups.com.
> > To unsubscribe from this group, send email to

> > webdriver+...@googlegroups.com<webdriver%2Bunsubscribe@googlegroups­.com>


> > .
> > For more options, visit this group at

> >http://groups.google.com/group/webdriver?hl=en.- Hide quoted text -
>
> - Show quoted text -

Eran M.

unread,
Mar 15, 2010, 3:04:05 AM3/15/10
to webd...@googlegroups.com
Hi,

Is there no other prompt regarding the untrusted certificates? The BadCert handler WebDriver installs should prompt when it considers every insecure site.

Eran

To unsubscribe from this group, send email to webdriver+...@googlegroups.com.

PerfectStorm

unread,
Mar 15, 2010, 9:24:47 AM3/15/10
to webdriver
I do get the prompt telling me there is an untrusted but it just fails
at that spot. When I stop the script right before the page I manually
step through the process and click add exception and add the exception
but I cannot move past the page no matter what I do. To get past this
screen I have to set acceptuntrustedcertificates to false and then I
can add the exception manually. What has become even more painful is
that I am using remote webdriver and I had to modify the extension
directly to set accept untrusted certificates to false

On Mar 15, 3:04 am, "Eran M." <eran....@gmail.com> wrote:
> Hi,
>

> Is there no other prompt regarding the untrusted certificates? The BadCert
> handler WebDriver installs should prompt when it considers every insecure
> site.
>
> Eran
>

> > > >http://groups.google.com/group/webdriver?hl=en.-Hide quoted text -

PerfectStorm

unread,
Mar 23, 2010, 3:25:14 PM3/23/10
to webdriver
Eran

Any idea what might be causeing this??

On Mar 15, 9:24 am, PerfectStorm <john.majc...@gmail.com> wrote:
> I do get the prompt telling me there is an untrusted but it just fails
> at that spot. When I stop the script right before the page I manually
> step through the process and click add exception and add the exception
> but I cannot move past the page no matter what I do. To get past this
> screen I have to set acceptuntrustedcertificates to false and then I
> can add the exception manually. What has become even more painful is
> that I am using remote webdriver and I had to modify the extension
> directly to set accept untrusted certificates to false
>
> On Mar 15, 3:04 am, "Eran M." <eran....@gmail.com> wrote:
>
>
>
> > Hi,
>
> > Is there no other prompt regarding the untrusted certificates? The BadCert
> > handler WebDriver installs should prompt when it considers every insecure
> > site.
>
> > Eran
>
> > On 12 March 2010 08:41, PerfectStorm <john.majc...@gmail.com> wrote:
>
> > > Eran
>
> > > I am still seeing the issue the following are the two errors I see in
> > > the error console
>

> > > Error: Attempted to connect to a site with a badcertificatein the

> > > > >certificateitselft. Now it works as

> > > > >http://groups.google.com/group/webdriver?hl=en.-Hidequoted text -


>
> > > > - Show quoted text -
>
> > > --
> > > You received this message because you are subscribed to the Google Groups
> > > "webdriver" group.
> > > To post to this group, send email to webd...@googlegroups.com.
> > > To unsubscribe from this group, send email to
> > > webdriver+...@googlegroups.com<webdriver%2Bunsubscribe@googlegroups­­.com>
> > > .
> > > For more options, visit this group at
> > >http://groups.google.com/group/webdriver?hl=en.-Hide quoted text -
>

> > - Show quoted text -- Hide quoted text -

Eran M.

unread,
Mar 23, 2010, 7:13:14 PM3/23/10
to webd...@googlegroups.com
Hi,

There's a known problem (on my TODO list - will probably get to it in two weeks) with SSL certificates containing wildcards for the common-name field. You could verify that this is your case by not disabling accepting untrusted SSL certificates (it's best to do it with a clean profile) and, after trying to access a secure site, see if the error console contains "host name mismatch". Let me know what the outcome of this is.

Eran

To unsubscribe from this group, send email to webdriver+...@googlegroups.com.

PerfectStorm

unread,
Mar 23, 2010, 7:44:48 PM3/23/10
to webdriver
Yes that is exactly the error host name mismatch where there is a
wildcard

Do you think your fix will make the next build?

Thanks for the quick response

On Mar 23, 7:13 pm, "Eran M." <eran....@gmail.com> wrote:
> Hi,
>

> There's a known problem (on my TODO list - will probably get to it in two
> weeks) with SSL certificates containing wildcards for the common-name field.
> You could verify that this is your case by not disabling accepting untrusted
> SSL certificates (it's best to do it with a clean profile) and, after trying
> to access a secure site, see if the error console contains "host name
> mismatch". Let me know what the outcome of this is.
>
> Eran
>

> > > > > > >http://groups.google.com/group/webdriver?hl=en.-Hidequotedtext -


>
> > > > > > - Show quoted text -
>
> > > > > --
> > > > > You received this message because you are subscribed to the Google
> > Groups
> > > > > "webdriver" group.
> > > > > To post to this group, send email to webd...@googlegroups.com.
> > > > > To unsubscribe from this group, send email to
> > > > > webdriver+...@googlegroups.com<webdriver%2Bunsubscribe@googlegroups­.com>
> > <webdriver%2Bunsubscribe@googlegroups­­.com>
> > > > > .
> > > > > For more options, visit this group at
> > > > >http://groups.google.com/group/webdriver?hl=en.-Hidequoted text -
>

> > > > - Show quoted text -- Hide quoted text -
>
> > > - Show quoted text -
>
> > --
> > You received this message because you are subscribed to the Google Groups
> > "webdriver" group.
> > To post to this group, send email to webd...@googlegroups.com.
> > To unsubscribe from this group, send email to

> > webdriver+...@googlegroups.com<webdriver%2Bunsubscribe@googlegroups­.com>
> > .
> > For more options, visit this group at

> >http://groups.google.com/group/webdriver?hl=en.- Hide quoted text -

Eran M.

unread,
Mar 24, 2010, 10:33:59 AM3/24/10
to webd...@googlegroups.com

Hi,

I hope it will be in the trunk in two weeks. The fix should be trivial,  if you want to try solving it yourself.  The badCertListener uses simple string comparison - it should use regex matching instead.

On 23 Mar 2010 23:44, "PerfectStorm" <john.m...@gmail.com> wrote:

Yes that is exactly the error host name mismatch where there is a
wildcard

Do you think your fix will make the next build?

Thanks for the quick response


On Mar 23, 7:13 pm, "Eran M." <eran....@gmail.com> wrote:
> Hi,
>

> There's a known problem (on my TODO list - will probably get to it in two

> weeks) with SSL certif...

> On 23 March 2010 19:25, PerfectStorm <john.majc...@gmail.com> wrote:
>
>
>
> > Eran
>

> > Any idea...

> > > > - Show quoted text -- Hide quoted text -
>
> > > - Show quoted text -
>
> > --

> > You recei...

--

You received this message because you are subscribed to the Google Groups "webdriver" group.

To post...

Eran M.

unread,
May 7, 2010, 10:10:43 AM5/7/10
to webd...@googlegroups.com
Hi,

This issue was fixed in r8825 - Should not detect a host name mismatch when the certificate is for an entire domain or contains wildcards that match the host name.

Eran
To post to this group, send email to webd...@googlegroups.com.
To unsubscribe from this group, send email to webdriver+...@googlegroups.com.

PerfectStorm

unread,
May 7, 2010, 3:46:16 PM5/7/10
to webdriver
Thanx

That will be a big help

Have you had a chance to look at issue 282 yet. That is really
starting to become a big problem. We can only test in firefox right
now.

On May 7, 10:10 am, "Eran M." <eran....@gmail.com> wrote:
> Hi,
>
> This issue was fixed in r8825 - Should not detect a host name mismatch when
> the certificate is for an entire domain or contains wildcards that match the
> host name.
>
> Eran
>
> On 24 March 2010 15:33, Eran M. <eran....@gmail.com> wrote:
>
>
>
>
>
> > Hi,
>
> > I hope it will be in the trunk in two weeks. The fix should be trivial,  if
> > you want to try solving it yourself.  The badCertListener uses simple string
> > comparison - it should use regex matching instead.
>
> > On 23 Mar 2010 23:44, "PerfectStorm" <john.majc...@gmail.com> wrote:
>
> > Yes that is exactly the error host name mismatch where there is a
> > wildcard
>
> > Do you think your fix will make the next build?
>
> > Thanks for the quick response
>
> > On Mar 23, 7:13 pm, "Eran M." <eran....@gmail.com> wrote:
> > > Hi,
>
> > > There's a known problem (on my TODO list - will probably get to it in two
> > > weeks) with SSL certif...
>
> > > On 23 March 2010 19:25, PerfectStorm <john.majc...@gmail.com> wrote:
>
> > > > Eran
>
> > > > Any idea...
>
> > > > > > - Show quoted text -- Hide quoted text -
>
> > > > > - Show quoted text -
>
> > > > --
> > > > You recei...
>
> > --
>
> > You received this message because you are subscribed to the Google Groups
> > "webdriver" group.
> > To post...
>
> --
> You received this message because you are subscribed to the Google Groups "webdriver" group.
> To post to this group, send email to webd...@googlegroups.com.
> To unsubscribe from this group, send email to webdriver+...@googlegroups.com.
> For more options, visit this group athttp://groups.google.com/group/webdriver?hl=en.- Hide quoted text -
>
> - Show quoted text -

--

sqa tester

unread,
May 18, 2010, 8:41:04 PM5/18/10
to webdriver
what's the best way to obtain this fix?

On May 7, 12:46 pm, PerfectStorm <john.majc...@gmail.com> wrote:
> Thanx
>
> That will be a big help
>
> Have you had a chance to look at issue 282 yet. That is really
> starting to become a big problem. We can only test in firefox right
> now.
>
> On May 7, 10:10 am, "Eran M." <eran....@gmail.com> wrote:
>
>
>
> > Hi,
>
> > This issue was fixed in r8825 - Should not detect a host name mismatch when
> > thecertificateis for an entire domain or contains wildcards that match the
> > For more options, visit this group athttp://groups.google.com/group/webdriver?hl=en.-Hide quoted text -

sqa tester

unread,
May 21, 2010, 2:17:50 PM5/21/10
to webdriver
is this checked in to the 2.0a4?
> > > For more options, visit this group athttp://groups.google.com/group/webdriver?hl=en.-Hidequoted text -
Reply all
Reply to author
Forward
0 new messages