epiphany (webkit) doesn't clearly warn about invalid SSL certificates

Note that you should see a broken "lock" in the bottom-left, but a warning dialog akin to firefox/chrome's is very important to protect sensitive information.

https://www.cacert.org/index.php?id=1 does not display a broken lock, but instead a locked lock.

I should also mention that there doesn't seem to be a way to import a CA. Eg, one test I perform for xulrunner updates is:
1. go to https://www.cacert.org/index.php?id=1 and verify the browser prompts for untrusted certificate
2. go to http://www.cacert.org/certs/root.crt to import the certificate
3. go to https://www.cacert.org/index.php?id=1 and verify the browser does not prompt

1 and 2 do not work with epiphany/webkit, but do with epiphany/gecko.

Hmm... likewise here.

How does epiphany decide what certificates to trust? It certainly rejects
https://i.broke.the.internet.and.all.i.got.was.this.t-shirt.phreedom.org/...

On Mon, Jun 7, 2010 at 11:24, Jamie Strandboge <email address hidden> wrote:

> https://www.cacert.org/index.php?id=1 does not display a broken lock,
> but instead a locked lock.
>
> --
> epiphany (webkit) does not verify SSL certificates
> https://bugs.launchpad.net/bugs/589877
> You received this bug notification because you are a direct subscriber
> of the bug.
>

--
Jeremy Nickurak -= Email/XMPP: <email address hidden> =-

Importing certificates is a different bug,
https://bugs.launchpad.net/ubuntu/+source/epiphany-extensions/+bug/42476 .
epiphany/gecko is unrelated, as it's entirely obsolete, deprecated, and
unsupported, afaik.

On Mon, Jun 7, 2010 at 11:30, Jamie Strandboge <email address hidden> wrote:

> I should also mention that there doesn't seem to be a way to import a CA.
> Eg, one test I perform for xulrunner updates is:
> 1. go to https://www.cacert.org/index.php?id=1 and verify the browser
> prompts for untrusted certificate
> 2. go to http://www.cacert.org/certs/root.crt to import the certificate
> 3. go to https://www.cacert.org/index.php?id=1 and verify the browser does
> not prompt
>
> 1 and 2 do not work with epiphany/webkit, but do with epiphany/gecko.
>
> --
> epiphany (webkit) does not verify SSL certificates
> https://bugs.launchpad.net/bugs/589877
> You received this bug notification because you are a direct subscriber
> of the bug.
>

--
Jeremy Nickurak -= Email/XMPP: <email address hidden> =-

It looks like newer epiphany uses the system-wide certificate pool in
/etc/ssl/certs, which (on my system) includes cacert.

It's still the case that this notification (for the bottom-left) is a tiny,
and insufficient warning that you're leaving a safe transmission medium.

On Mon, Jun 7, 2010 at 11:45, Jeremy Nickurak <email address hidden> wrote:

> Importing certificates is a different bug,
> https://bugs.launchpad.net/ubuntu/+source/epiphany-extensions/+bug/42476 .
> epiphany/gecko is unrelated, as it's entirely obsolete, deprecated, and
> unsupported, afaik.
>
>
> On Mon, Jun 7, 2010 at 11:30, Jamie Strandboge <email address hidden> wrote:
>
>> I should also mention that there doesn't seem to be a way to import a CA.
>> Eg, one test I perform for xulrunner updates is:
>> 1. go to https://www.cacert.org/index.php?id=1 and verify the browser
>> prompts for untrusted certificate
>> 2. go to http://www.cacert.org/certs/root.crt to import the certificate
>> 3. go to https://www.cacert.org/index.php?id=1 and verify the browser
>> does not prompt
>>
>> 1 and 2 do not work with epiphany/webkit, but do with epiphany/gecko.
>>
>> --
>> epiphany (webkit) does not verify SSL certificates
>> https://bugs.launchpad.net/bugs/589877
>> You received this bug notification because you are a direct subscriber
>> of the bug.
>>
>
>
>
> --
> Jeremy Nickurak -= Email/XMPP: <email address hidden> =-
>
>

--
Jeremy Nickurak -= Email/XMPP: <email address hidden> =-

I can confirm that https://i.broke.the.internet.and.all.i.got.was.this.t-shirt.phreedom.org/ does show the broken lock, and agree it is not nearly enough of a warning. Turning the location bar red might be an easy way to implement this, but the confirmation dialog would be better IMHO.

I brought up gecko only to illustrate that pushing epiphany/webkit as is to Ubuntu 8.04 LTS would be a regression for those users.

I made note of the certificate import issue, and can add it to the USN when epiphany is pushed to hardy.

Upstream marked as duplicate.