On 26 December 2013 20:39, jan i <j...@apache.org> wrote: > On 26 December 2013 19:17, sebb <seb...@gmail.com> wrote: > >> On 26 December 2013 10:28, Andrea Pescetti <pesce...@apache.org> wrote: >> > On 23/12/2013 sebb wrote: >> >> >> >> ... >> >> http://wiki.services.openoffice.org/wiki/Documentation/FAQ/Installation >> >> >> >> Confirm with IE, which reports a certificate for *.apache.org (Thawte) >> > >> > >> > I've seen it happening from time to time, regardless of the browser I >> use, >> > but randomly: at times, loading a wiki page gives the "certificate >> mismatch" >> > error, but I am unable to reproduce it consistently. Almost always the >> > certificate is correct and the browser does not complain. >> > >> > Today I could investigate it better. At the time of writing this, if I >> open >> > http://wiki.services.openoffice.org/wiki/Documentation/FAQ/Installation >> > with any of the browsers I commonly use, the certificate I get is the >> right >> > one (for *.openoffice.org, issued 11 June 2013). Though, if I fire up >> an old >> > Konqueror I get the *.apache.org certificate, issued on 20 December >> 2011, >> > and thus the "mismatch" warning. >> > >> > Experience with wget is quite complex too. >> > >> > With wget 1.12: >> > $ wget https://wiki.openoffice.org/wiki/Documentation/FAQ/Installation >> > ERROR: certificate common name “*.apache.org” doesn’t match requested >> host >> > name “wiki.openoffice.org”. >> >> I get the same with 1.11.4 on WinXP. >> > > It works for me, with firefox and IE on win7, but wget 1.14 fails on the > same vm. > > I have a theory an would like it confirmed > > @andrea, @sebb, please have a look in certificate manager/servers, and > check is wiki.openoffice.org is there, if its in there please tell me in > which group? >
I'm not sure how to check this, sorry. > > >> >> > With wget 1.14: >> > $ wget https://wiki.openoffice.org/wiki/Documentation/FAQ/Installation >> > [works as expected] >> >> On minotaur, I get >> >> ERROR: cannot verify wiki.openoffice.org's certificate, issued by >> '/C=US/O=DigiCert Inc/CN=DigiCert Secure Server CA': >> Unable to locally verify the issuer's authority. >> >> Adding --no-check-certificate allows wget to work with a Warning: >> >> WARNING: cannot verify wiki.openoffice.org's certificate, issued by >> '/C=US/O=DigiCert Inc/CN=DigiCert Secure Server CA': >> Unable to locally verify the issuer's authority. >> >> > With wget 1.13.4 from ooo-wiki2-vm (so this is repeatable by others): >> > $ wget https://wiki.openoffice.org/wiki/Documentation/FAQ/Installation >> > ERROR: certificate common name `*.apache.org' doesn't match requested >> host >> > name `wiki.openoffice.org'. >> > >> > To avoid misunderstandings: this page does not currently contain any >> > "insecure" content. This is a separate problem, see below. >> > >> > Might it be that the *.apache.org certificate is served as a fallback to >> > some older clients that for some reason do not support the *. >> openoffice.org >> > one? >> >> Could be true. >> > > If you trace tcp/ip, is seems there are 2 requests for certificate from > wget. I dont think the reason is the certificate itself, but more the root > chain. There was a problem similar to this when the certificate was > installed. > > rgds > jan I. > > >> > >> >> Does not happen in Firefox for me either, though I do get a shield >> >> icon [1] indicating that there is some http: reference that needs to >> >> be changed to https: >> >> [IE also reports the same issue, if one ignores the cert. error] >> > >> > >> > I investigated this on the VM as far as my permissions allow. It should >> be >> > due to the hardcoded "http" in the file GoogleCoop/GoogleCoop.php >> > >> > To work around this, I've temporarily removed the "Search within the >> FAQs" >> > function that was including Google CSE via http, see >> > >> https://wiki.openoffice.org/w/index.php?title=Documentation%2FFAQ%2FInstallation&diff=232487&oldid=188626 >> > >> > Does this solve the "insecure content" problem for you? It does for me. >> >> Yes, Firefox, Opera are now happy, as is IE once on gets past the cert >> error. >> >> > The right fix would then to change http to https in >> > GoogleCoop/GoogleCoop.php but I can't modify that file. >> > >> > Regards, >> > Andrea. >> > >> > >> > --------------------------------------------------------------------- >> > To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org >> > For additional commands, e-mail: dev-h...@openoffice.apache.org >> > >> >> --------------------------------------------------------------------- >> To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org >> For additional commands, e-mail: dev-h...@openoffice.apache.org >> >> --------------------------------------------------------------------- To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org For additional commands, e-mail: dev-h...@openoffice.apache.org
