Firefox 'bad certificate' warning blocks navigation with small secured frames

Thanks for your bug report, and especially for the screenshot. This is actually a problem that should be solved in some way.

On Sun, Jun 01, 2008 at 09:06:34PM -0000, Miguel Diago wrote:
> Public bug reported:
>
> Binary package hint: firefox-3.0
>
> When you access a secure webpage whose certificate has been signed by an
> unknown authority, you are redirected to a warning message and taken out
> of the website. This can be a problem when there are only some parts of
> the webpage that are secured, like iframes. In such cases, the alert
> about using an untrusted certificate can be bigger than the iframe
> itself and so the user can't click the link to add an exception and
> continue browsing the website.
>
> For example, to reproduce this:
> 1. Go to http://www.renfe.es/
> 2. In the left-hand column, in the "Compra de billetes" box, select one random element from the first roll menu.
> 3. See how the box becomes "secure" and a cropped security alert is shown in which the bottom link to add an exception can't be accessed.
>

Interesting point. Reed, are you aware if this was also raised
upstream?

 affects firefox
 affects xulrunner

 affects ubuntu/firefox-3.0
 status incomplete
 affects ubuntu/xulrunner-1.9
 status incomplete

 - Alexander

The website I put as an example has changed the way the box works, and I don't know about any other examples for this bug :(

Miguel Diago wrote:
> The website I put as an example has changed the way the box works, and I
> don't know about any other examples for this bug :(
>
Do you mean that the site you were having issues with has fixed the issue?

--
Sincerely Yours,
     John Vivirito

https://launchpad.net/~gnomefreak
https://wiki.ubuntu.com/JohnVivirito
Linux User# 414246

This is what he means. But many other sites are likely to use this kind of embedded SSL frames - though this behavior is not really recommended as regards security.

This is more or less the same problem as with embedded frames, when the frames are from other server and it times out. You can't click on the retry button, like you can't here to add an exception.

Anyway, two bads things for Renfe, first: bad SSL cert, and SSL embedded frames...guess they'll care when firefox-3.0 final is released, or maybe they just tell to use IE.
Thing is, whats the difference on fixing this and fixing embbeded frames timing out? The latter occurs since firefox 1.0 or older...

We are closing this bug report because it lacks the information we need to investigate the problem, as described in the previous comments. Please reopen it if you can give us the missing information, and don't hesitate to submit bug reports in the future. To reopen the bug report you can click on the current status, under the Status column, and change the Status back to "New". Thanks again!