Safari 5 - accessing SSL website

Forums › Mac OS › Safari 5 - accessing SSL website

Aaroona

3204 posts

Uber Geek
+1 received by user: 169

#63151 21-Jun-2010 22:12

I've noticed, that I cant seem to (or very rarely am able to) load my college webmail.

I used to be able to prior to safari 5/10.6.4 - but seem to be having issues now.

Can someone please try loading the page in Safari (on the Mac) and see how long it takes to load?

https://wces01.wgpcollege.school.nz and https://webmail.wgpcollege.school.nz

EDIT: Oh, an can you try clicking the padlock in the top right hand corner and see if that freezes safari?

Then, can you load up https://www.bnz.co.nz, perform the above steps, and tell me if there is any difference.

my guess is that the schools SSL certificate is bust, but I'm trying to confirm before I bug the crap out of them to fix it.

Safari is the only web browser effected - firefox works fine, and IE works fine on Windows.

NZCoderGuy

513 posts

Ultimate Geek
+1 received by user: 1

Trusted

Kiwi Dev Studios

#343972 21-Jun-2010 22:21

It appears to be running slow on Chrome in Windows XP here. (the webmail site anyway), and giving me notices about the certificate being invalid.

--
Stephen
twitter/ NZCoderGuy / KiwiDevStudios

Aaroona

3204 posts

Uber Geek
+1 received by user: 169

#343974 21-Jun-2010 22:23

NZCoderGuy: It appears to be running slow on Chrome in Windows XP here. (the webmail site anyway), and giving me notices about the certificate being invalid.

So running slow in comparison to bnz's https site?

freitasm

BDFL - Memuneh
80646 posts

Uber Geek
+1 received by user: 41030

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#343978 21-Jun-2010 22:27

It's not a problem withy Safari. I just tried loading these sites on IE8 and https://webmail.wgpcollege.school.nz came with a certificate error:

Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

tomgeeknz

923 posts

Ultimate Geek
+1 received by user: 11

#343979 21-Jun-2010 22:27

iPod touch safari gives me invalid certificate errors in both school cases while bnz loads fine.

Aaroona

3204 posts

Uber Geek
+1 received by user: 169

#343980 21-Jun-2010 22:34

freitasm: It's not a problem withy Safari. I just tried loading these sites on IE8 and https://webmail.wgpcollege.school.nz came with a certificate error:

[Removed image]

What I'm trying to determine though MF is why, because it doesn't have any issues going to the site after accepting the cert in Firefox or IE (6, when tested). Yet, Safari seems to just totally become unresponsive to the website, if it doesnt load (and when it does, it does it slowly.) Then trying to click the Padlock just freezes Safari for a good minute or so, so either i have to force close or way.

Safari on the iPhone seems to be able to handle it as well it seems (from tomgeeknz's post above). And I just tested it myself, and had no issues after accepting the cert.

EDIT: After visiting another website with a cert error (thanks Stephen!), I'm fairly certain that its a certificate error. The website he linked me to worked fine, without any issues after I accepted the certificate.

I will talk to IT tomorrow and see if I can get it ironed out. For a school - this is pretty poor. It's not like they haven't got the funding to do it properly. But anyways, I will update later.

Thanks for testing guys, keep them coming if you dont mind, specially if you are on a Mac with Safari (4 or 5).

nickc

3 posts

Wannabe Geek

#347238 2-Jul-2010 11:11

Hi There

I'm an engineer for the company which manages your school network.

The school is indeed using a self-signed certificate for their webmail, which will show up as an untrusted certificate if you dont have the public key of the certificate authority which signed it installed in your browser.

As the school is currently running an Exchange 2010 server, the server requires either a wildcard or SAN cert as the server is accessed via different names depending weather it is a user with a browser or Outlook talking to it, or a phone or something else. FYI a SSL cert like BNZ has (verisign class 3 extended validation) with the needed 4 Subject Alternative Names for Exchange 2010 costs 7,310AUD per year

While I agree we should sort out an externally signed cert, your brower shouldnt crash when an invalid ceritificate is presented.

As a work around, I have put the CA cert in your home drive, \\wcfp02\studentshome$\Year13\Aaron.Tanner\Documents\wcfp01CAcert.cer. You should install it on your laptop as a Trusted Root Ceritication Authority. Not 100% sure how to do this on a Mac but im sure you can figure it out with some googling. Probbaly just click it or something and the mac will do it automagically.

If this is still an issue, I suggest you pop down to the IT support center there first thing after the holidays and the technican there will be able to supply you with the public cert of the CA.

I will pass on that a properly signed cert on the webmail will help the students out, wildcard ones shouldnt be too much. We were not aware people could not load the webmail.

HP

Shop now for HP laptops and other devices (affiliate link).

Aaroona

3204 posts

Uber Geek
+1 received by user: 169

#347260 2-Jul-2010 12:09

nickc: Hi There

I'm an engineer for the company which manages your school network.

The school is indeed using a self-signed certificate for their webmail, which will show up as an untrusted certificate if you dont have the public key of the certificate authority which signed it installed in your browser.

As the school is currently running an Exchange 2010 server, the server requires either a wildcard or SAN cert as the server is accessed via different names depending weather it is a user with a browser or Outlook talking to it, or a phone or something else. FYI a SSL cert like BNZ has (verisign class 3 extended validation) with the needed 4 Subject Alternative Names for Exchange 2010 costs 7,310AUD per year

While I agree we should sort out an externally signed cert, your brower shouldnt crash when an invalid ceritificate is presented.

As a work around, I have put the CA cert in your home drive, \\wcfp02\studentshome$\Year13\Aaron.Tanner\Documents\wcfp01CAcert.cer. You should install it on your laptop as a Trusted Root Ceritication Authority. Not 100% sure how to do this on a Mac but im sure you can figure it out with some googling. Probbaly just click it or something and the mac will do it automagically.

If this is still an issue, I suggest you pop down to the IT support center there first thing after the holidays and the technican there will be able to supply you with the public cert of the CA.

I will pass on that a properly signed cert on the webmail will help the students out, wildcard ones shouldnt be too much. We were not aware people could not load the webmail.

Hi Nick,

Thanks for replying - quite surprised to get a reply from someone actually managing this school!

Yeah the SSL certificates are definitely not cheap! It's just that I didn't have any other certificate at the time to compare it to - but then after trying another unsigned certificate (on a mates work site), and found Safari processed it fine, it really came down to just the school one.

I have just installed the certificate you put in my documents folder, but I will try it out when I get home later on this afternoon, so I will post back with the results.

I think the reason why more people have not raised a concern about this is because there aren't too many Macs here at school, maybe 5 students all up, and not many other students use Safari or Chrome (Firefox and IE being the top two choices, which oddly enough work fine when trying to get to webmail).

-Aaron

nickd

447 posts

Ultimate Geek
+1 received by user: 1

#347292 2-Jul-2010 14:07

It's like big brother in here....

nickc

3 posts

Wannabe Geek

#347296 2-Jul-2010 14:31

Aaroona

3204 posts

Uber Geek
+1 received by user: 169

#347303 2-Jul-2010 14:49

nickc: lol

A staff member at the school pointed us to this

Also, the webmail would load faster if the students got off YouTube. Their internet up in Whangaparoa is only 2x adsl2+ load balanced with pfSense :P

Oh really? lol.

Haha! we can't get on YouTube! With the amount of restrictions we have enforced with GetBusi, we can hardly even check our personal email, let alone surf YouTube.

Our current internet quota per student is 300mb per month (which has only just been increased from 120mb), so the only YouTube stuff that happens is the stuff that the staff load up! :P

For some reason I thought we were on faster then that. That's surprising.

-Aaron

nickc

3 posts

Wannabe Geek

#347455 3-Jul-2010 02:23

Just thought I would clarify all posts I make are the opinion of myself and not the School concerned or my company.