9

I have an existing site that works fine over http and https (SSL). The SSL certificate is valid and can be confirmed by inspecting in the browser.

I am starting to use a manifest file to enable the HTML5 application cache on my website. This is useful for making the page load faster, and eventually for offline capabilities. This is working great when using a regular http connection. The problems happens when accessing the site over https (SSL). When I do this, I can access my website's content just fine, and the URL says "https" however I see the following behavior:

Safari: It displays the lock icon, but when I click the lock icon to inspect the certificate, it says that the certificate is invalid.

Firefox: Does not display the colored address bar indicating encryption, and when inspecting the certificate, it says that there is no certificate.

Chrome and Opera: Correctly displays the secure nature of the URL, and when clicking the lock icon it displays the SSL certificate information. Yes!

I understand that using the application cache causes resources to be served locally from the browser, and as such there is no encryption happening, however customers don't necessarily know that there is an application cache happening in the background, and they are expecting to see a valid SSL certificate and indications that the connection is secure. Safari and Firefox appear to be doing this incorrectly, unless I am missing something. That is my question. Does anyone know how to get Safari and Firefox to display the SSL certificate for pages served from the application cache? Is there something special that you need to do, or is it a Safari and Firefox bug?

2
  • 1
    So, did you come up with any solution?
    – jakubmal
    May 4, 2012 at 19:51
  • I have not found a solution. As far as I know, these are Safari and Firefox bugs.
    – Jake
    May 7, 2012 at 15:44

3 Answers 3

1

I believe someone has discussed this with me before. Please let me know if this helps.

Change all of your script and css references from http:// or https:// to //.

If you haven't any then it is moot, but if you do, please let me know if that has an effect.

I believe this may be related to not being able to verify the references from a cached page.

0

Based on the history of vulnerabilities, I'd guess this may have been overlooked for the sake of fixing more critical issues. That said, I think this should be reported to both vendors now that some of the glaring vulnerabilities have been patched. Have you tested this with the latest releases of Firefox and Safari?

0

Did you serve the application manifest over SSL?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.