Can't access to a valid secured website (https://www.clusif.asso.fr/)

[jcourtois86]

I'm trying to access to https://www.clusif.asso.fr/. It works ok on Chrome or Firefox but QupZilla return that the connexion is not secured.

The certificate is a sha1 and TLS1.0 but is still valid, the connexion should be authorized.

[JHooverman]

Please let us know about your configuration (Menu -> Configuration information) as shown in the following example:

Application version: 1.9.0 (ee80b04)
Qt version: 5.4.2
WebKit version: 538.1
Build time: Jan 25 2015 16:47:02
Platform: openSUSE Tumbleweed (Linux)

In addition, please visit this site and post the contents of the section Protocol Features here. This is how it looks for me:

[jcourtois86]

I used the last portable version on Windows

Application version: 1.8.9
Qt version: 5.5.1
WebKit version: 538.1
Platform: Windows 7

I have the same look as you for protocols:
TLS 1.2 Yes
TLS 1.1 Yes
TLS 1.0 Yes
SSL 3 No
SSL 2 No

Can you access to this website without problem with the last QupZilla release?

[JHooverman]

@johnlamericain: Yes, I am able to access this page with QupZilla master branch, compiled against qt-5.6 & qtwebengine. This issue describes probably the reason for your problem. Connecting with TLS 1.0 to servers will make QupZilla vulnerable to the BEAST attack.

@nowrep: Although QupZilla seems to support TLS 1.0/ 1.1 and 1.2 it seems, that it will always try to connect with TLS 1.2 - no fallback. Is that correct?

[jcourtois86]

Ok, so even my protocols show TLS 1.0 Yes, it still doesn't try to access the website with that protocol?

Is it the responsability of the website to update its protocol?

[debguy]

first note git / github asks for $$ from some, while offering GPL wares it is controlling/re-writing to be release only under "github" access: this is sure to lead to pulling the rug out from under those who trust "git" not to do this.

next notice to view github you have to have https working to discuss https NOT working, and git is now using the MICROSOFT logo for saying "we do not support GPL'ed browsers unless a release recently released using GIT sourced build". now back to the question

as usual, you should search for other questions before asking:

#1249

i had this issue, and like "taint commented Mar 2, 2014" got certificats (grabbed from firefox 20, as qupzilla-1.8.0 came with only 1 and author suggested to me in an email to mind the detail, so i did)

https://github.com/QupZilla/qupzilla/raw/master/src/lib/data/data/ca-bundle.crt

HOWEVER, when i click that i get an error from git saying the file no longer exists. also i did have a file of same name in qz that was infact used (i had made sure after getting the email).

i may beleive it is not a qz problem, but i'm still not conviced it isn't a qt-everywhere-4.7.x (or above) problem. qt doesn't give me any option but openssl, the openssl i have works with everthing else, and qt uses it without showing any error, and qt demos run (i have yet to confirm that ssl demos connect anywhere as i have no demo ssl site to test wit)

finally, qz-1.8.0 does crash for me (a glib issue is on error stack: likely again from qt) but is very quick and nice on particular sites, depends on why one opened a browser. if i wish to use qz with https sites i may just add my own option (cut-out) to connect without security if i choose, and i only say that because i cannot "fully upgrade to newest pc and newest linux" to try the newer qz.

i haven't confirmed any qz bugs (but qz heavily relies on a qt that is NOT from apple and might contain malware)

what i have confirmed is that if one has compiled a linux, from scratch, that compiles qt that accepts versions in build chain: qt is buggy. it's releases are "controlled by admins" and it's 150 mb source. 4.7.4 takes hours to build BUT to compile 4.7.0 it took 4 days on a machine i had do it. thats a long time to wait to see if a source code fix has been fixed: it's unrepairable too. it contains suspicious licenses too - showing licenses of (many)(source components) that aren't from the original creators.

overall i suggest to people having SSL problems: heed authors advice, and if it doesn't work, find out why his platform's qt is working and yours isn't

thank you