OS2 World Community Forum
OS/2, eCS & ArcaOS - Technical => Internet => Topic started by: Neil Waldhauer on January 14, 2020, 12:59:35 am
-
I'm hoping to get some help figuring out a problem I have with Google search.
If I search for the term "OS/2 Consulting", the Blonde Guy consulting page comes up as item number one. If I click on it in Firefox (SUa2) for OS/2, nothing happens. If I click on it in Safari for iPhone, the page comes up as expected.
What is going on?
-
HA!
Weird, but same behaviour here...not sure why, other than the fact that on FF45.9 there doesn't actually appear to be a Page Source present...almost like : there is no page there! Ughhh????
-
I get the same behaviour with SeaMonkey and DuckDuckGo (default in SM) accept it is the about page and the same behaviour if I manually enter https://www.blondeguy.com/ (https://www.blondeguy.com/).
I usually see this behaviour when the TLS/SSL type is unsupported by our NSS.
I'll test with a newer build that is linked against the NSS DLLs in netlabs-exp
-
Same results with the newer version linked against NSS 3.47 though I didn't reboot to get the updated certs, just used BEGINLIBPATH.
Seems to use TLS1.2 which should work, did you try loading it since the 4th when you updated the certificate? Where are you hosting, on your own machine?
-
It's a website hosted by cruzio. They let me control it using plesk, but I'm having trouble configuring secure http, apparently.
OK, I tried with Qupzilla. It works fine to search from google or from duck duck go.
-
Hmm, if the old Qupzilla works, it might not be HTTPS, in which case I have no idea. Qupzilla here won't even load ddg even after installing the SSL fix.
-
If you don't want tracked and hassled don't use google use Duck Duck Go.
-
Hi
It does not look to me that is a Google issue.
I can not access https://blondeguy.com/about.html (directly) from Firefox 45.9.0 (and Firefox 38). Can you confirm that ?
I tried https and http and it does not work.
From Windows I can access it. ...by the way, good picture Neil ;D
Regards
-
Hi Neil
Using Seamonkey 2.42.9esr I cannot access https://blondeguy.com at all but http://blondeguy.com seems to be working if "News: Dec 24, 2019:" is current. Other http: pages seem to work - quite enjoyed the blonde joke ;-)
Regards
Pete
-
No problem, works with FF31.8.0.
Joop
-
I was fooling with the server settings. There was a window where http://www.blondeguy.com was visible. It's gone now, and none of the website will show in Firefox 45 SUa2. I can verify that Firefox 31 has no problems accessing https:/www.blondeguy.com, even correctly identifying my certificate.
-
Does http://www.blondeguy.com/ (http://www.blondeguy.com/) now redirect to https://www.blondeguy.com/ (https://www.blondeguy.com/)?
This is even weirder if FF31ESR works as it uses an older version of NSS. Unluckily I'm at a loss on how to troubleshoot this as it is like the browser gives up really early. It's a shame we don't have a functioning debug version of 45ESR.
-
Yes. That's what I changed today.
It works in our Firefox 31ESR, but not in Firefox 45 SUa2. It also works in iPhone Safari and iPad Firefox. I've set up the redirect in plesk, which has the server send a 301 message with the redirect. I still have many corrections to make to the website, but I'd like to figure out this security problem if I can.
-
My solution is to leave some pointers to the http://www.blondeguy.com/ (http://www.blondeguy.com/) website for OS/2 users to use with Firefox 45 and 38 for OS/2. Other versions and plaforms work fine and can use the secure website https://www.blondeguy.com (https://www.blondeguy.com)
I do not know what is different about my website compared to others that do work.
-
I tried a website called SSL Server Test to test my website, and I can now see that several browsers will have problems. Here is the test page:
https://www.ssllabs.com/ssltest/analyze.html?d=www.blondeguy.com (https://www.ssllabs.com/ssltest/analyze.html?d=www.blondeguy.com)
-
Hi Neil
I'm sorry if I'm not completely following the discussion. Testing it a little bit more, it seems that is something related to the DNS and the SSL of your site.
If I connect directly with the IP address (without https) I can visit your website from Firefox 45.9. With https I'm not able to access your site (warning appears).
I have no idea why if I access https://www.blondeguy.com, the OS/2 browser don't even give it a try to load the page.
I'm not the one that made and installed the SSL certificate for OS2World server, so I'm not sure how this works.
Regards
-
I have temporarily made it possible to connect using http:.
In the future, a 301 directive will forward an http: request to https:
I want Firefox 45 (and Chrome 49 and IE 8) to be able to connect, too. All other browsers listed in the report (in my prior posting on page 1) work fine on https: now.
The problem is in the configuration of ciphers on nginx. I don't think I have access to that, so I'll need to open a ticket with my upstream provider.
-
Be nice to know why FF31 can connect while later versions don't as well. Considering FF31 is running even an older NSS, it is unexpected that it works.
-
To load https://www.blondeguy.com/ (https://www.blondeguy.com/) in FF45.9, go to about:config search for security.tls.version and change security.tls.version.fallback-limit andsecurity.tls.version.max to 2 (default is 3). Possibly only version.max needs changing.
For SM, just go to Preferences-->Privacy & Security-->SSL/TLS and uncheck the TLS 1.2 box.
FF31 likely worked due to not supporting TLS1.2.
-
Hi Dave
The problem with unchecking the TLS 1.2 box is that other sites then do not load instead displaying the following:-
An error occurred during a connection to theartofsound.net.
Peer reports incompatible or unsupported protocol version.
Error code: <a id="errorCode"
title="SSL_ERROR_PROTOCOL_VERSION_ALERT">SSL_ERROR_PROTOCOL_VERSION_ALERT</a>
Regards
Pete
-
I'm not surprised though I haven't come across that error yet.
What unchecking the box does tell us is that either Niel's site and/or our browser has a problem with TLS 1.2.
For now it is a workaround if someone wants to buy Suntan Special or such but as you hint at, the preference should be changed back for most sites. If only due to TLS 1.2 being more secure.