<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"><meta http-equiv="Content-Type" content="text/html charset=us-ascii"><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class="">Thanks for the response.</div><div class=""><br class=""></div><span class="">This bug initially surfaced for me when iceweasel was upgraded from 30 to 31 about three months ago. I re-tested for the behavior after upgrading the package yesterday and am getting the same result: attempting to make a TLS connection to a server that uses a self-signed certificate hangs without returning an error. This is puzzling since the bug reports out there seem to indicate people are experiencing the bug by having the connection fail with a non-overridable error reported, which is different from having the connection not do anything at all. </span><div class=""><span class=""><br class=""></span></div><div class=""><span class="">This is an</span> <a href="about:config" class="">about:config</a> workaround, with this setting I am able to override the certificate error and connect to my site:</div><div class=""><div class=""><span class=""><br class=""></span></div><div class=""><span class="">security.use_mozillapkix_verification = false</span></div><div class=""><span class=""><br class=""></span></div><div class=""><span class="">This does strongly indicate that the problem is linked to the introduction of mozilla::</span>pkix.</div><div class=""><br class=""></div><div class="">I realize that I should re-test with a clean profile, it could be that there are old certificates and/or plugins in my regular browsing profile that are causing problems. To investigate further, I will see about setting up a dummy server with the guilty certificates to see if you can reproduce.</div><div class=""><br class=""></div><div class="">Thanks,</div><div class="">Peter</div><div class=""><br class=""><div class=""><blockquote type="cite" class=""><div class="">On Nov 21, 2014, at 5:51 PM, Mike Hommey <<a href="mailto:mh@glandium.org" class="">mh@glandium.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class="">On Fri, Nov 21, 2014 at 03:49:06PM -0500, Peter Amstutz wrote:<br class=""><blockquote type="cite" class="">Package: iceweasel<br class="">Version: 31.2.0esr-3<br class="">Severity: important<br class="">Tags: upstream<br class=""><br class="">Dear Maintainer,<br class=""><br class="">Firefox 31 introduced a new certificate validation library "mozilla::pkix".<br class="">This introduced regressions, where previously the user could override the<br class="">validation error and connect anyway ("this connection is untrusted!"), in<br class="">jessie iceweasel attempting to connect to the same sites results in a silent<br class="">hang (it appears to be loading forever with no feedback as to what is wrong).<br class=""><br class="">(Subjectively, when this happens it also appears to affect the overall<br class="">stability of the browser, as it seems like other sites become slow to load or<br class="">fail to load entirely until the browser is restarted).<br class=""><br class="">Based on the following discussion, it appears that this behavior is addressed<br class="">Firefox 33, and in the Enterprise Support Release (ESR) of Firefox 31:<br class=""><br class=""><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1042889" class="">https://bugzilla.mozilla.org/show_bug.cgi?id=1042889</a><br class=""></blockquote><br class="">That bug is fixed in 33 and 31.2, both of which are in Debian already.<br class="">Are you saying the versions in Debian are still affected?<br class=""><br class="">Mike<br class=""></div></blockquote></div><br class=""></div></div></body></html>