Bug 528504

Summary: Thunderbird 3 beta in F11 cannot create exceptions for self signed certs.
Product: [Fedora] Fedora Reporter: Reilly Hall <sly.midnight>
Component: thunderbirdAssignee: Gecko Maintainer <gecko-bugs-nobody>
Status: CLOSED WORKSFORME QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: high Docs Contact:
Priority: low    
Version: 12CC: gecko-bugs-nobody, mcepl
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2010-01-15 17:50:52 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
Add security exception dialog
none
Failed to identify site...
none
Console Error Log none

Description Reilly Hall 2009-10-12 14:33:36 UTC
Description of problem:
Ok, upgraded to F11 and load up the updated and current version of Thunderbird 3.0beta4 and open up my email accounts (all of which support SSL). 2 IMAP and 1 POP3.  1 of the IMAP accounts uses a legit SSL/TLS cert being a gmail account.  The POP3 account same, being from my ISP.  The last account, being the second IMAP account is one actually hosted on a personal server I have where I created my own SSL certificates using OpenSSL.  They are naturally self-signed and therefore a warning about this and the requirement to set an exception is expected.  When the warning appears and the possibility to set an exception is presented, an error complaining about not being able to Identify site appears and you are not permitted to set an exception.  Even manually installed the certificates in question as an exception does not solve this problem (presumably because it needs to be done at the time the warning is presented).  In Windows this works ok, in Fedora 11, both x86_64 and i586, its broken.

Version-Release number of selected component (if applicable):
3.0beta3 and 3.0beta4

How reproducible:
Always

Steps to Reproduce:
1. Setup an IMAP account that requires SSL using a self-signed or otherwise bad certificate.
2. Attempt to connect to the account and wait for the SSL warning to appear.
3. Notice that the warning does not allow you to set an exception because it claims it cannot Identify site.
  
Actual results:
Cannot set exception as expected.

Expected results:
Should see the warning as expected but be able to download and view/verify the certificate manually to decide if I wanna set an exception and do so at my discretion.

Additional info:
Thank God for KMail...

Comment 1 Matěj Cepl 2009-10-29 23:33:34 UTC
Created attachment 366733 [details]
Add security exception dialog

This is the dialog I get when I get to the IMAP server without appropriate certificate installed. Do you get this dialog at all or not? If yes, and you click on "Get certificate" button, what happens? If you get a certificate, could you (after inspecting it with "View") click on "Confirm Security Exception"?

Sorry, if I am asking something which is completely obvious and banal to you, but it is hard to discern over the bugzilla level of knowledge on the other side of the web form.

Thank you in advance for any reply

Comment 2 Reilly Hall 2009-10-30 12:51:25 UTC
Created attachment 366793 [details]
Failed to identify site...

Not a problem, its a perfectly reasonable assumption.  I see that for you it seems to work.  But I've attached then the screen (window) shot of what I get.  It first says "Attempting to identify site..." or something along those words and then ends with this.  And as you can see it does not allow me to click on anything other than cancel.  And if I click any of the folders pertaining to that account it just brings up that useless window again.  The only thing I can see is that you might be using gnome where I am using KDE, but would that even matter?

Comment 3 Matěj Cepl 2009-11-04 14:09:08 UTC
Hmm, testing here both on Gnome and KDE and it seems to just work. Do you use gtk-qt-engine by chance or kcm-gtk? Could you switch it off and retest? We had some reports of its malfunctioning some portions of Firefox in the past.

Thank you for any reply

Comment 4 Reilly Hall 2009-11-04 17:42:40 UTC
How would I know which I'm using?  I also just got curious here at work and setup from scratch the account in Thunderbird 3b4 on my F11 i586 install and it worked!  This didn't seem to work before.  Maybe my Thunderbird profile didn't upgrade too well from 2.0 or the 3b3 update hosed it somehow?  I'm tempted to just rename the ~/.thunderbird directory and start from scratch (though that would hurt setting everything back up from scratch).  But I'd like to try your suggestion first...how would I know if I'm using gtk-qt-engine or kcm-gtk and how would I go about changing it to test further?

Thanks!

Comment 5 Reilly Hall 2009-11-04 19:16:03 UTC
Ok, I just nuked the profile directory and started from scratch.  Now it just hangs with the correct settings put in place on the account setup wizard saying "Thunderbird is looking up the settings for your email account." The username is green, after specifying the correct SMTP server settings and retesting, it too is green.  But after 5 minutes, the correct IMAP server settings are still "swirling" or testing.  I get the impression it somehow cannot connect to the port, what gives?  It doesn't look like its going to time out either.

Comment 6 Reilly Hall 2009-11-04 20:52:52 UTC
Created attachment 367535 [details]
Console Error Log

This is really starting to drive me nuts.  Even if I delete the account, any manually or previously automatically imported certificates and recreate the account, it hangs on the IMAP server config portion of the wizard and if you try it like 10 times, a few of those times it will actually connect, and when it does though, it throws the same error regarding not being able to identify the site.  

However if I remove the ~/.thunderbird profile completely and deal with the same account wizard profile creation madness of most of the time not being able to connect to the IMAP SSL port, it will actually connect and authenticate me!  But WITHOUT EVER throwing a certificate exception dialog!!! What the heck is going on!?  This is not even consistent.  And it will continue to connect without an exception even after I close Thunderbird.  It will only revert back to its old behavior if I reattempt account creation after once again removing the profile directory.  But its still a random shot because again, 9 out of 10 times it will claim it cannot identify site, and then that 1 last time it will actually connect and authenticate me and download my mail, but WITHOUT ever throwing a cert exception.

Comment 7 Reilly Hall 2009-11-05 18:31:23 UTC
Just an update...it appears that now that I've got a profile with the account setup after trying and retrying until it magically went through, while it does not throw up the window to create an exception for the cert, one is somehow magically created on its own.  Why would repeating the same steps $rm -rf ./.thunderbird and running thunderbird after that and going through the wizard with the same username password and server name like 20 times yield different results almost every time?  Something's not quite right about that.

Comment 8 Matěj Cepl 2009-11-06 00:25:14 UTC
So, what about trying to understand what's going on between the THunderbird and your server.

Could you take a look at https://wiki.mozilla.org/MailNews:Logging#Linux.2Funix and generate imaps logs, please? Run these commands in terminal:

export NSPR_LOG_MODULES=imap:5
export NSPR_LOG_FILE=/tmp/thunderbird-imap-log.txt
thunderbird

and then try to reproduce the issue again. Don't do anything else than just configure to that one account. Then quit thunderbird and attach /tmp/thunderbird-imap-log.txt to this bug as uncompressed separate attachment.

Thank you very much

Comment 9 Bug Zapper 2009-11-16 13:33:10 UTC
This bug appears to have been reported against 'rawhide' during the Fedora 12 development cycle.
Changing version to '12'.

More information and reason for this action is here:
http://fedoraproject.org/wiki/BugZappers/HouseKeeping

Comment 10 Reilly Hall 2009-12-09 21:10:46 UTC
Hey guys, I haven't forgotten about this bug.  Just been busy.  I've since upgraded to F12, but haven't had time to test again.  I will hopefully do that by this weekend.  So far it seemed to work as expected in an i686 clean installation (no previous profile) on F12 on my laptop.  Will test again on the home computer where it matters most.

Comment 11 Reilly Hall 2010-01-15 17:49:46 UTC
Guys, I just tested it again on a clean Thunderbird profile (no ~/.thunderbird folder) on my recently upgraded F12 x64 install on the same machine and it works as expected.  Also works the same way on my i686 F12 install on my laptop.  Both are using the official Thunderbird 3.0 release.  So I'm assuming it was either fixed silently between the original beta releases or something in Fedora itself that supported Thunderbird changed between F11 and F12 that fixed the issue, so I'm gonna close this bug report if I can, unless someone says otherwise.  Thanks, for hearing me out though.