False positive?

[nbkuy]

Hello, I suspect of an FP @ https://ketarin.org/forum/ that is blocked accordingly, can someone more knowleadgeble confirm? Thank you. BTW I'm using latest Convergence with FF 7.0.1, i've removed cert from cache but error is reproduced again. Neither FF or Chromium flag this cert as bad

[ewanm89]

Duplicate of #28, looks like the server is using SNI.

[nbkuy]

This is very inconvenient, since I'm blocked, I need to disable Convergence OR change browser. Has a cert/domain whitelist been considered/requested?

[ewanm89]

The problem isn't the actual verification, it's that when twisted visits the site (as happens with perspectives based convergence notaries) they see the site as a different domain, and so convergence generates a certificate for that other site.

[moxie0]

@nbkuy There is an exception handler for Convergence failures, but unfortunately this isn't the case here. Everything is checking out correctly on the Convergence side of things, so this isn't a Convergence exception. The problem is that the certificate which is being received by both Convergence and the browser is valid for the names "forum.cdburnerxp.se" and "www.forum.cdburnerxp.se".

I'm going to close this as a duplicate of #28, and we can continue to talk about resolutions there.