Re: Server Certificates (Bug?)

Subject: Re: Server Certificates (Bug?)

From: Jürgen Schweizer <email@hidden>

Date: Fri, 29 Apr 2005 00:17:19 +0200

Delivered-to: email@hidden

On 28.04.2005, at 22:16, Darin Adler wrote:

Here's a response from someone here at Apple on the security team that is not subscribed to this mailing list.

On Apr 28, 2005, at 7:57 AM, Jürgen Schweizer wrote:

I am having trouble loading sites that present a certificate.

Which sites? Is this all sites, or just sites that have a specific certificate?

It is https://nscu.www6.memberdirect.net/Personal/ (under construction by one of our users)

Even if the certificate is in my keychain and the Trust Settings are "Always Trust" WebKit will still fail to load (responding with "bad server certificate").

The site's certificate doesn't go into your keychain.

It actually did (it went into the "Certificates" group) once I opened the site with Safari 412 and hit "continue" after Safari presented me with "Safari can't verify the identity...".

If *every* site that uses certificates is failing, one possibility is that your /System/Library/Keychains/X509Anchors keychain file is missing. You may want to run Keychain First Aid (under the application menu in Keychain Access) to verify that your configuration is OK; it will tell you if there is any problem with X509Anchors.

No problems found.

Are you getting a sheet that says, "Safari can't verify the identity of <site>"? If so, are you clicking Continue? Or does an error page appear immediately?

When I am trying to load the site WebKit calls the delegate method

- (void)webView:(WebView *)sender didFailProvisionalLoadWithError:(NSError *)error forFrame:(WebFrame *)frame

with code -1203 (bad server certificate).

Looking up the nscu.www6.memberdirect.net certificate in my login.keychain (in the Certificates group) reveals the message "This certificate was signed by an unknown authority".

So I guess the questions boils down to, whether there is a method to force WebKit to load a specific site even if its identity cannot be verified? (so I can present my users with a similar dialog as Safari does)

Thanks for helping out Darin!

-Juergen

_______________________________________________ Do not post admin requests to the list. They will be ignored. Webkitsdk-dev mailing list (email@hidden) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/webkitsdk-dev/email@hidden This email sent to email@hidden

References:

>Server Certificates (Bug?) (From: Jürgen Schweizer <email@hidden>)

>Re: Server Certificates (Bug?) (From: Darin Adler <email@hidden>)