http://bugzilla.novell.com/show_bug.cgi?id=544188 User lnussel@novell.com added comment http://bugzilla.novell.com/show_bug.cgi?id=544188#c1 --- Comment #1 from Ludwig Nussel 2009-10-04 10:23:52 MDT --- hmm, could be due to the SSLListen directive with an IP address -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=544188 User jsmeix@novell.com added comment http://bugzilla.novell.com/show_bug.cgi?id=544188#c3 Johannes Meixner changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P3 - Medium Status|NEW |NEEDINFO Found By|--- |Development Info Provider| |lnussel@novell.com --- Comment #3 from Johannes Meixner 2009-10-06 01:06:25 MDT --- I run CUPS 1.3.11 on my openSUSE 11.1 workstation with an unchanged /etc/cups/cupsd.conf (same package as for 11.2 but built for 11.1) and I use MozillaFirefox-3.0.5 as Browser. When I go to http://localhost:631/admin/ there is no redirect. I set up a new queue via the CUPS web interface and there was no redirect at all. Can you provide information how to reproduce? Please attach your /etc/cups/cupsd.conf file as MIME type text/plain. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=544188 User jsmeix@novell.com added comment http://bugzilla.novell.com/show_bug.cgi?id=544188#c6 Johannes Meixner changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P3 - Medium |P4 - Low Status|NEW |ASSIGNED Target Milestone|--- |Future 11.3 Severity|Normal |Minor --- Comment #6 from Johannes Meixner 2009-10-06 01:41:25 MDT --- Ah! Now I get in my Firefox first: -------------------------------------------------------------------- 426 Upgrade Required You must access this page using the URL https://10.10.4.228:631/admin/. -------------------------------------------------------------------- which does after a few seconds an automated redirect to https://10.10.4.228:631/admin/ but this results -------------------------------------------------------------------- Secure Connection Failed :631 uses an invalid security certificate. The certificate is not trusted because it is self signed. The certificate is only valid for (Error code: sec_error_untrusted_issuer) [...] ... you can add an exception ... -------------------------------------------------------------------- In contrast https://:631/admin/ results only -------------------------------------------------------------------- Secure Connection Failed :631 uses an invalid security certificate. The certificate is not trusted because it is self signed. (Error code: sec_error_untrusted_issuer) [...] ... you can add an exception ... -------------------------------------------------------------------- which is o.k. because the autogenerated certificate can be only self signed. In both cases one must "add an exception" and after this the CUPS web interface works o.k. Therefore it is only a minor issue. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=544188 User jsmeix@novell.com added comment http://bugzilla.novell.com/show_bug.cgi?id=544188#c8 Johannes Meixner changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |NEEDINFO Info Provider| |lnussel@novell.com --- Comment #8 from Johannes Meixner 2009-10-06 03:19:00 MDT --- It works for me when I set in /etc/cups/cupsd.conf HostNameLookups On The default is Off to avoid the potential server performance problems with hostname lookups, see http://www.cups.org/documentation.php/doc-1.3/ref-cupsd-conf.html#HostNameLo... By default, i.e. when "HostNameLookups Off" the code in scheduler/client.c --------------------------------------------------------------------------- if (HostNameLookups) httpAddrLookup(&temp, con->servername, sizeof(con->servername)); else httpAddrString(&temp, con->servername, sizeof(con->servername)); --------------------------------------------------------------------------- does not do httpAddrLookup which would result the hostname but only httpAddrString which converts the IP to a numeric string which is then used for the redirect. Therefore from my point of view it works as intended and -a s far as I see - the only solution would be an autogenerated certificate which is valid both for and . Ludwig, do you know if it is possible to autogenerate a certificate which is valid both for and ? -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=544188 User lnussel@novell.com added comment http://bugzilla.novell.com/show_bug.cgi?id=544188#c10 Ludwig Nussel changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |ASSIGNED Info Provider|lnussel@novell.com | --- Comment #10 from Ludwig Nussel 2009-10-06 03:48:42 MDT --- Yes, it is possible to add an arbitrary number of additional hostnames or ip addresses to certificate (subjAltName). However, the more I think about it the more I come to the conclusion that an autogenerated certificate just can't work this way. - there's no guarantee that the local hostname is resolvable or has a fqdn at all - /etc/HOSTNAME is likely not resolveable (linux-xyz.site) - the system is reachable via multiple names (e.g. hostname.local for zeroconf) - the system has an arbitrary, dynamic number of ip addresses (IPv4LL, IPv6LL, DHCP, dial up interfaces etc ...) It's possible to generate certificates without a CN though. The error message of the browser then at least doesn't say it's for the wrong host. Firefox says the certificate doesn't provide identity information then which is at least correct information :-) -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=544188 User lnussel@novell.com added comment http://bugzilla.novell.com/show_bug.cgi?id=544188#c13 Ludwig Nussel changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |RESOLVED Resolution| |WONTFIX --- Comment #13 from Ludwig Nussel 2009-10-06 06:01:46 MDT --- Weird, the German translation sounds much friendlier: "Es wurden keine Server-Namen gefunden, für die dieses Zertifikat gültig ist." Anyways, this issue is not solvable in any satisfactory way. Closing WONTFIX. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=544188 User lnussel@novell.com added comment http://bugzilla.novell.com/show_bug.cgi?id=544188#c15 --- Comment #15 from Ludwig Nussel 2009-10-06 06:58:58 MDT --- That's a rather ugly way. Openssl has C API functions for creating certificates. On the command line it's possible to specify a config file that contains all values instead of running openssl interactively and piping input. In the config file there's a subjectAltName setting. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=544188 User jsmeix@novell.com added comment http://bugzilla.novell.com/show_bug.cgi?id=544188#c17 Johannes Meixner changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |REOPENED Platform|Other |All Resolution|WONTFIX | OS/Version|Other |SuSE Other Severity|Minor |Enhancement --- Comment #17 from Johannes Meixner 2009-10-06 07:49:39 MDT --- Reopening as possible enhancement for CUPS 1.4 -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.