pfSense Support Subscription

Author Topic: [SOLVED] webConfigurator do not answer IPv6 requests  (Read 7436 times)

0 Members and 1 Guest are viewing this topic.

Offline Luzemario

  • Jr. Member
  • **
  • Posts: 75
  • Karma: +2/-0
    • View Profile
    • Internet Services
Re: [SOLVED] webConfigurator do not answer IPv6 requests
« Reply #15 on: August 11, 2013, 09:24:49 am »
Update: This issue was reported upstream:

https://bugzilla.mozilla.org/show_bug.cgi?id=903853

Crossing fingers to Firefox team to fix it as soon as possible. IPv6 deployment in my country is getting huge attention, as IPv4 blocks here are giving last signals of life...  ;)
Cheapest hosting - Bom e barato! - www.luzehost.com.br :D

Offline kejianshi

  • Hero Member
  • *****
  • Posts: 4949
  • Karma: +195/-40
  • Debugging...
    • View Profile
Re: [SOLVED] webConfigurator do not answer IPv6 requests
« Reply #16 on: August 11, 2013, 10:14:52 am »
Hmmmm.   Hopefully we can all go IPV6 soon, dump IPV4 before IPV9 comes out and then maybe Firefox would notice all the broken browsers.

Offline doktornotor

  • Hero Member
  • *****
  • Posts: 8553
  • Karma: +956/-278
  • Not a pfSense employee, they cannot fire me...
    • View Profile
Re: [SOLVED] webConfigurator do not answer IPv6 requests
« Reply #17 on: August 11, 2013, 10:59:05 am »
Hmmmm.   Hopefully we can all go IPV6 soon, dump IPV4 before IPV9 comes out and then maybe Firefox would notice all the broken browsers.

The guys are just "amazing". The bug's been there for ages, just regressing badly recently, making it much worse (previously you'd just get the usual self-signed cert nagscreen, but you could not add an exception for IPv6 literal. Now you get a blank page...) Instead of fixing the darned thing, the guys discuss that they "intend to discourage certificates that include IP addresses." Apparently realizing that the user is not in a position to do anything about whatever certificate that the admin decided to use is way above the guys' heads. Clearly, browsers are not there to browse websites any more, they are there to nag users with stupid warnings (self-signed certs are baaad, mkay... CNNIC one's rock though, that's what Mozilla trusts.) And this idiocy is not limited to Mozilla, e.g. Chrome won't let you browse local XML files, since XSL stylesheets are extremely "dangerous". They are much safer when downloaded from web, mkay, riiight!
Do NOT PM for help!

Offline kejianshi

  • Hero Member
  • *****
  • Posts: 4949
  • Karma: +195/-40
  • Debugging...
    • View Profile
Re: [SOLVED] webConfigurator do not answer IPv6 requests
« Reply #18 on: August 11, 2013, 11:07:26 am »
I doubt its a bug.  More likely its something designed to generate revenue by making people run out and grab "Good signed certs" that make pretty green banner colors when you browse to a site.  Exploiting stupidity is a time honoured tradition.  We all know that certs are so much more trustworthy when they were generated and signed by some yahoo you don't even know.

Offline Luzemario

  • Jr. Member
  • **
  • Posts: 75
  • Karma: +2/-0
    • View Profile
    • Internet Services
Re: [SOLVED] webConfigurator do not answer IPv6 requests
« Reply #19 on: August 11, 2013, 11:15:48 am »
I agree with you both. Here government sites .gov.br are signed by a centralized government entity called "ICP Brasil". This entity is trusted, but browsers refuse to add it to your root cert list by unknown reasons. There are plenty of bug requests asking to add the ICP's root cert, but it seems it will never be done...
Cheapest hosting - Bom e barato! - www.luzehost.com.br :D

Offline kejianshi

  • Hero Member
  • *****
  • Posts: 4949
  • Karma: +195/-40
  • Debugging...
    • View Profile
Re: [SOLVED] webConfigurator do not answer IPv6 requests
« Reply #20 on: August 11, 2013, 11:42:40 am »
Well - The Military here and government (Serious sites for serious people, not for public use) don't submit their certs to anybody.
Shows up red just like any self signed cert I'd make unless the people who use them install the certs in their trusted cert store.
Thats also how I handle certs. Handed out by hand for friends I'd trust to certain things.

But really - Certs have become a huge racket.  I'd say issuing certs is like printing money except paper does cost SOMETHING.

Offline Klaws

  • Full Member
  • ***
  • Posts: 253
  • Karma: +14/-3
    • View Profile
Re: [SOLVED] webConfigurator do not answer IPv6 requests
« Reply #21 on: August 12, 2013, 05:20:33 am »
But really - Certs have become a huge racket.  I'd say issuing certs is like printing money except paper does cost SOMETHING.

You mean - you could operate a company which issues digital certificates from your parent's garage, and become a multi-millionaire? Amazing.

http://en.wikipedia.org/wiki/Mark_Shuttleworth

Of course, this is impossible to repeat nowadays. Shuttlework (Thawte) and Verisign were lucky enough to have their root certificates public key installed in the first Netscape browser. The rest is history.

Offline doktornotor

  • Hero Member
  • *****
  • Posts: 8553
  • Karma: +956/-278
  • Not a pfSense employee, they cannot fire me...
    • View Profile
Re: [SOLVED] webConfigurator do not answer IPv6 requests
« Reply #22 on: August 12, 2013, 05:25:39 am »
You mean - you could operate a company which issues digital certificates from your parent's garage, and become a multi-millionaire? Amazing.

Been tried and failed... Clearly, these days you need to pay $$$$$$$ to the right browser guys first, like CNNIC. ::)
Do NOT PM for help!

Offline Klaws

  • Full Member
  • ***
  • Posts: 253
  • Karma: +14/-3
    • View Profile
Re: [SOLVED] webConfigurator do not answer IPv6 requests
« Reply #23 on: August 12, 2013, 05:53:35 am »
Yep...too bad that Honest Achmed failed...now I have to buy my google.com certificates from TÜRKTRUST....

Offline kejianshi

  • Hero Member
  • *****
  • Posts: 4949
  • Karma: +195/-40
  • Debugging...
    • View Profile
Re: [SOLVED] webConfigurator do not answer IPv6 requests
« Reply #24 on: August 12, 2013, 11:32:56 am »
I suppose it would be possible to start a open-authority (call it whatever you like) the same way OpenNIC runs alternate DNS.  You would have to set up an entirely new chain of authority, some servers, establish some system of trust and basically give away certs and rely on donations or something to keep things running.  Then you would need to get it into a major browser that isn't in CNNIC or whoever's pocket.  OR - People could just stop being stupid and ignore the idiot graffiti that pops up when someone uses a self signed cert.  Either way would work.

Did I mention the word racket earlier?  Yeah...   Its a racket.

Offline doktornotor

  • Hero Member
  • *****
  • Posts: 8553
  • Karma: +956/-278
  • Not a pfSense employee, they cannot fire me...
    • View Profile
Re: [SOLVED] webConfigurator do not answer IPv6 requests
« Reply #25 on: September 06, 2013, 05:58:29 am »
Do NOT PM for help!

Offline kejianshi

  • Hero Member
  • *****
  • Posts: 4949
  • Karma: +195/-40
  • Debugging...
    • View Profile
Re: [SOLVED] webConfigurator do not answer IPv6 requests
« Reply #26 on: September 06, 2013, 06:29:04 am »
Ahhhh-  Good.  Getting ready for IPV9 are they?