5

This question is inspired by a bug/issue in recent Linksys router firmware. Essentially, something has changed recently that's preventing HTTPS access to the web admin on current generation Linksys routers (E4200 and E3000 specifically, although others might be affected as well). This problem shows up in IE, Firefox, Chrome, and Opera, but interestingly not in Safari.

Does Safari handle HTTPS connections in some way that's different from every other browser? Is it accepting SSL certificates that other browsers deem invalid for some reason? I tried doing some research on whether Safari is known to be more lenient when validating SSL certificates but I came up empty. Anyone have any ideas/experience with how Safari handles HTTPS?

Edit: Clarification on "preventing HTTPS access". The error page that gets displayed varies somewhat by browser, but most of them indicate that the connection was reset while the page was loading. IE provides the least informative message simply stating that "Internet Explorer cannot display the webpage". My next step I suppose will be installing Ethereal to see if I can get a better idea of what's actually happening.

Improve this question
14
  • Did you check if Safari's settings don't automatically accept untrusted ssl certificates?
    – tftd
    Feb 25, 2012 at 4:19
  • 2
    Can you check in another browser (e.g., chrome) why the HTTPS connection is being rejected?
    – dr jimbob
    Feb 25, 2012 at 4:22
  • @tftd Near as I can tell there's nothing like that in the config. It warns me that the certificate is self signed and can't be verified like all the other browsers, and after I add an exception it works.
    – Orclev
    Feb 25, 2012 at 6:42
  • 1
    That's also the error if you try ssl on http, or http on ssl port.
    – ewanm89
    Feb 25, 2012 at 13:11
  • 1
    @Iszi This isn't so much about the router as it is about the way Safari handles SSL certificates that other browsers seem to think are invalid in some fashion. I didn't feel a IT security forum was the proper place to deal with issues with a bug in router firmware, but accepting invalid SSL certificates certainly is.
    – Orclev
    Feb 25, 2012 at 18:33

1 Answer 1

Reset to default
1

With Safari, if it cannot validate the certificate, for example because it is self-signed or is signed by an untrusted CA or, quite often, because the server is not sending the intermediate certificate, you can click the "Continue" button on the error dialog and it will automatically store an exception to trust this certificate for this site for the rest of the session (until you quit the browser). You also have the option of showing the certificate and explicitly saving it as trusted so it will always be trusted in the future.

There is also a preference option to some kinds of certificate errors in general. In the Security pane of the Preferences window, you can uncheck "Warn when visiting a fraudulent website." I believe that just fixes host-certificate name mismatches, not invalid certificates in general, but I'm not sure.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .