1. Due to issues with external spam filters, QQ is currently unable to send any mail to Microsoft E-mail addresses. This includes any account at live.com, hotmail.com or msn.com. Signing up to the forum with one of these addresses will result in your verification E-mail never arriving. For best results, please use a different E-mail provider for your QQ address.
    Dismiss Notice
  2. For prospective new members, a word of warning: don't use common names like Dennis, Simon, or Kenny if you decide to create an account. Spammers have used them all before you and gotten those names flagged in the anti-spam databases. Your account registration will be rejected because of it.
    Dismiss Notice
  3. Since it has happened MULTIPLE times now, I want to be very clear about this. You do not get to abandon an account and create a new one. You do not get to pass an account to someone else and create a new one. If you do so anyway, you will be banned for creating sockpuppets.
    Dismiss Notice
  4. If you wish to change your username, please ask via conversation to tehelgee instead of asking via my profile. I'd like to not clutter it up with such requests.
    Dismiss Notice
  5. Due to the actions of particularly persistent spammers and trolls, we will be banning disposable email addresses from today onward.
    Dismiss Notice
  6. A note about the current Ukraine situation: Discussion of it is still prohibited as per Rule 8
    Dismiss Notice
  7. The rules regarding NSFW links have been updated. See here for details.
    Dismiss Notice
  8. The testbed for the QQ XF2 transition is now publicly available. Please see more information here.
    Dismiss Notice
Mail delivery issues Usernames Rule 4 Clarification Username Change Requests Disposable Email Addresses Ukraine Rule update XF2 testbed available

Bug: HTTPS session is fragile

Discussion in 'Suggestions & Bugs' started by Ampersandwich, Mar 7, 2015.

  1. Ampersandwich

    Ampersandwich Outl&ish Gr& Panj&rum

    Joined:
    Mar 5, 2014
    Messages:
    1,020
    Likes Received:
    2,130
    When you're logged in using https://, if you click an http:// link, your login session is invalidated.

    This isn't just "you have to log in again to use HTTP", but "your HTTPS login session is trashed also". As many links in signatures and the like have http:// hardcoded into them, this is problematic, to say the least. (It would be nice to promote these to https:// when under https anyway, though.)
     
    Ampersandwich, Mar 7, 2015
    #1
    Ddmkm122 likes this.
  2. alethiophile

    alethiophile Shadowed Philosopher Administrator

    Joined:
    Apr 26, 2013
    Messages:
    7,611
    Likes Received:
    53,713
    Hmm.

    I'm tempted to make http redirect to https for everyone by default, because more TLS is always better. But I'd need to figure that out.

    I find that when logged in via http, I can follow https links without problem. So there's that.
     
    alethiophile, Mar 7, 2015
    #2
    Ddmkm122 likes this.
  3. Ampersandwich

    Ampersandwich Outl&ish Gr& Panj&rum

    Joined:
    Mar 5, 2014
    Messages:
    1,020
    Likes Received:
    2,130
    Merely redirecting wouldn't quite suffice; the initial URL request would still be transmitted over HTTP.
     
    Ampersandwich, Mar 8, 2015
    #3
    Ddmkm122 likes this.
  4. Nuit

    Nuit L'immortale Capo

    Joined:
    Feb 12, 2013
    Messages:
    832
    Likes Received:
    3,298
    Can these at least be https when you're already on an https page?

    [​IMG]
     
    Nuit, Mar 8, 2015
    #4
    Ddmkm122 likes this.
  5. alethiophile

    alethiophile Shadowed Philosopher Administrator

    Joined:
    Apr 26, 2013
    Messages:
    7,611
    Likes Received:
    53,713
    All forum-created links should now point to https by default. I can't do anything about links manually specified in posts, at least not from the XF end. Maybe I'll look into rewrite rules or something tomorrow.
     
    alethiophile, Mar 10, 2015
    #5
    Ddmkm122, Walkir and Nuit like this.
  6. tehelgee

    tehelgee The stern gaze of justice. Administrator

    Joined:
    Feb 12, 2013
    Messages:
    2,910
    Likes Received:
    12,707
    I keep getting an error at the https url.

    Secure Connection Failed
    An error occurred during a connection to forum.questionablequesting.com. The OCSP server suggests trying again later. (Error code: sec_error_ocsp_try_server_later)
     
    tehelgee, Mar 10, 2015
    #6
    Ddmkm122 likes this.
  7. alethiophile

    alethiophile Shadowed Philosopher Administrator

    Joined:
    Apr 26, 2013
    Messages:
    7,611
    Likes Received:
    53,713
    I had that as well. A workaround is to go into Firefox about:config and disable OCSP stapling. I have no idea of the deeper significance; that error message is truly unhelpful. However, since it's OCSP, it seems likely to be somehow related to the server TLS cert.
     
    alethiophile, Mar 10, 2015
    #7
    Ddmkm122 likes this.
  8. tehelgee

    tehelgee The stern gaze of justice. Administrator

    Joined:
    Feb 12, 2013
    Messages:
    2,910
    Likes Received:
    12,707
    Yeah, that fixed it.

    What's weird is that it was working fine with it enabled and browsing in https then it just started throwing the error message out of the blue.
     
    tehelgee, Mar 10, 2015
    #8
    Ddmkm122 likes this.
  9. alethiophile

    alethiophile Shadowed Philosopher Administrator

    Joined:
    Apr 26, 2013
    Messages:
    7,611
    Likes Received:
    53,713
    Yeah. OCSP is the protocol used to check for revocation of a TLS cert, so the obvious answer is that something's wrong with its registration. But the error message is just...what? "Suggest you try again later?" How the hell does that help?

    If this goes on too long I'll probably set the defaults back to HTTP. I like the idea of having it be HTTPS in the long run, though. Where was the current certificate acquired from?
     
    alethiophile, Mar 11, 2015
    #9
    Ddmkm122 likes this.
  10. UrsaTempest

    UrsaTempest Yuri Fanatic, Archivist

    Joined:
    May 16, 2013
    Messages:
    5,678
    Likes Received:
    14,545
    Hmm, with my dorm connection I got OCSP error, but with Campus there's no error.

    The cert is signed by StartCom Ltd.
     
    UrsaTempest, Mar 11, 2015
    #10
    Ddmkm122 likes this.
  11. tehelgee

    tehelgee The stern gaze of justice. Administrator

    Joined:
    Feb 12, 2013
    Messages:
    2,910
    Likes Received:
    12,707
    As weepingman points out, StartCom was the issuer of the certificate. It was free, so.
     
    tehelgee, Mar 11, 2015
    #11
    Ddmkm122 likes this.
  12. Walkir

    Walkir Super Happy Awesome Fun Time On Vacation

    Joined:
    Feb 1, 2014
    Messages:
    11,227
    Likes Received:
    37,263
    Almost as well as "Ask your system administrator". As if talking to myself would help...
     
    Walkir, Mar 11, 2015
    #12
    Ddmkm122, alethiophile and Valette-Serafina like this.
  13. UrsaTempest

    UrsaTempest Yuri Fanatic, Archivist

    Joined:
    May 16, 2013
    Messages:
    5,678
    Likes Received:
    14,545
    Yeah, confirmed. I got OCSP error on dorm, but no error on campus. Maybe it is a matter of old HTTPS certificate? Hmm, gonna try deleting it and try again.

    EDIT: I still got the same error when I delete QQ's old certificate.
     
    Last edited: Mar 11, 2015
    UrsaTempest, Mar 11, 2015
    #13
    Ddmkm122 likes this.
  14. Plotvitalnpc

    Plotvitalnpc Personification Personified

    Joined:
    Mar 22, 2013
    Messages:
    19,128
    Likes Received:
    76,306
    For me, only the 'Home' button on the top bar and the QQ logo actually seem to use HTTPS, and when I click on those I get the error.
    Everywhere else I click I get Forum.Questionablequesting.com
     
    Plotvitalnpc, Mar 12, 2015
    #14
    Ddmkm122 likes this.
  15. tehelgee

    tehelgee The stern gaze of justice. Administrator

    Joined:
    Feb 12, 2013
    Messages:
    2,910
    Likes Received:
    12,707
    Internal links would be targeting http not https. Those have to be manually changed.
     
    tehelgee, Mar 12, 2015
    #15
    Ddmkm122 likes this.
  16. Plotvitalnpc

    Plotvitalnpc Personification Personified

    Joined:
    Mar 22, 2013
    Messages:
    19,128
    Likes Received:
    76,306
    *shrugs*
    As long as a complete switchover fixes the whole set of problems, I'd be fine with it.
    The moment an attempt to improve something makes things worse, I'll become a reactionary trying to bring back the days where everything was insecure, but did what it said it would without you having to make concessions to it.
     
    Plotvitalnpc, Mar 12, 2015
    #16
    Ddmkm122 likes this.
  17. alethiophile

    alethiophile Shadowed Philosopher Administrator

    Joined:
    Apr 26, 2013
    Messages:
    7,611
    Likes Received:
    53,713
    The issue seems to relate to any loading anything over HTTPS. My change made the home links automatically target HTTPS; however, the generated internal links (all the stuff like list of threads in a forum, &c.) choose protocol based on what they were loaded through. The wild card is links hard-coded in posts, which are whatever they were written as, and the site can't really change them. (Okay, there could be a dynamic link rewriter, but I don't think XF has that.)
     
    alethiophile, Mar 12, 2015
    #17
    Ddmkm122 likes this.
  18. UrsaTempest

    UrsaTempest Yuri Fanatic, Archivist

    Joined:
    May 16, 2013
    Messages:
    5,678
    Likes Received:
    14,545
    Curious. HTTPS now works on dorm connection, too. Not sure why. The only change I remember is deleting QQ old certificate, but there's no immediate effect for doing that...
     
    UrsaTempest, Mar 12, 2015
    #18
    Ddmkm122 likes this.
  19. macdjord

    macdjord Well worn.

    Joined:
    Feb 20, 2013
    Messages:
    8,831
    Likes Received:
    36,790
    Different browsers? Or different security settings on the same browser?

    Huh. Seems to be working for me now, too. ... I guess 'try again later' really was the solution~
     
    macdjord, Mar 12, 2015
    #19
    Ddmkm122 likes this.
  20. UrsaTempest

    UrsaTempest Yuri Fanatic, Archivist

    Joined:
    May 16, 2013
    Messages:
    5,678
    Likes Received:
    14,545
    Nah, I don't change browser. I do need to login with my Student ID*, but it is otherwise identical.

    *well, it is technicallly some other poor smuck's Student ID, not mine. But still!
     
    UrsaTempest, Mar 12, 2015
    #20
    Ddmkm122 likes this.
  21. UrsaTempest

    UrsaTempest Yuri Fanatic, Archivist

    Joined:
    May 16, 2013
    Messages:
    5,678
    Likes Received:
    14,545
    Yyyyeah, I got OCSP error again.
     
    UrsaTempest, Mar 12, 2015
    #21
    Ddmkm122 likes this.
  22. justaguy

    justaguy Getting out there.

    Joined:
    Jun 12, 2014
    Messages:
    15
    Likes Received:
    66
    TL;DR: Server admins, disable OCSP stapling in the server software. End-users, disable OCSP stapling in your browser. The full explanation goes like this:

    OCSP Error Code 3: Try Again Later. The most annoying OCSP error to ever exist.

    Some background information: The OCSP protocol is used to check whether or not a certificate has been revoked. This is done in real time - whenever your browser makes a secure connection to a website, it also connects to an OCSP responder server to check the current validity of a certificate. The OCSP server then returns a response (the certificate is/is not valid) or an error code (something went wrong).

    These servers are run by the Certificate Authority that issued the certificate. As you can imagine, they get a lot of requests. OCSP servers are notoriously unreliable - they go down all the time just due to the sheer load they have to deal with. tryLater, or "sec_error_ocsp_try_server_later" means that the OCSP server is overloaded and can't be contacted at the moment. This is such a common problem that browsers will ususally just ignore this error.

    "OCSP Stapling" was designed to fix this problem. Instead of every user asking the OCSP server if a certificate is valid, the website contacts the OCSP server. Then, it stores the OCSP response in a cache, and presents the (digitally signed) cached response to every client that tries to connect to the website. The OCSP response is "stapled" to the SSL certificate that QQ presents. This reduces the load on the OCSP server massively.

    Unfortunately, QQ is not stapling an OCSP response (your certificate is valid/invalid). Instead, QQ is stapling an OCSP error code (try again later). So when QQ asks the OCSP server "Hey, has my certificate been revoked?", the OCSP server's response is "Gah! I'm way too busy right now, ask me again later!" QQ then says "Hmm, okay." and stores that "try again later" error code in its cache. QQ then naively presents the error code to the user as though it were a valid OCSP response. This, naturally, trips up the user's browser and causes an error to appear.

    This seems like a bug - either the QQ server shouldn't store and staple an error code, or browsers should ignore the error code if it's stapled to a certificate. Browsers already ignore the "try again later" error code if it's received from the OCSP server directly.

    End-user workaround: In Firefox, go to about:config, and temporarily set security.ssl.enable_ocsp_stapling to false. I don't know how to do something similar in other browsers.

    Caveat: I think this is how it works, but I may not fully understand the protocol or the situation. I am not a systems/networking engineer. Or any kind of engineer, for that matter.

    References:

    https://tools.ietf.org/html/rfc6960#section-2.3
    https://en.wikipedia.org/wiki/Online_Certificate_Status_Protocol
    https://en.wikipedia.org/wiki/OCSP_Stapling
     
    justaguy, Mar 15, 2015
    #22
    Ddmkm122, 1986ctcel, alethiophile and 3 others like this.
  23. alethiophile

    alethiophile Shadowed Philosopher Administrator

    Joined:
    Apr 26, 2013
    Messages:
    7,611
    Likes Received:
    53,713
    This is pretty consistent with what I've found.

    I've now disabled OCSP stapling on the server-side. If anyone else gets this error, please do note.
     
    alethiophile, Mar 15, 2015
    #23
    Ddmkm122 and justaguy like this.
  24. justaguy

    justaguy Getting out there.

    Joined:
    Jun 12, 2014
    Messages:
    15
    Likes Received:
    66
    Seems to be fixed, thanks!
     
    justaguy, Mar 15, 2015
    #24
    Ddmkm122 likes this.
  25. alethiophile

    alethiophile Shadowed Philosopher Administrator

    Joined:
    Apr 26, 2013
    Messages:
    7,611
    Likes Received:
    53,713
    QQ now redirects all HTTP requests to HTTPS, which should resolve the issue for which this thread was actually started.
     
    alethiophile, Mar 17, 2015
    #25
    Ddmkm122 and justaguy like this.
  26. Ampersandwich

    Ampersandwich Outl&ish Gr& Panj&rum

    Joined:
    Mar 5, 2014
    Messages:
    1,020
    Likes Received:
    2,130
    Post-server-move, this is no longer true.

    Also, the QQ 'Home' links (those pointed out by NuitTombee above) are to a bare IP address.
     
    Ampersandwich, Mar 29, 2015
    #26
    Ddmkm122 likes this.
  27. tehelgee

    tehelgee The stern gaze of justice. Administrator

    Joined:
    Feb 12, 2013
    Messages:
    2,910
    Likes Received:
    12,707
    It's temporary, due to the move.

    We'll get it sorted, don't worry.
     
    tehelgee, Mar 29, 2015
    #27
    Ddmkm122 likes this.