On 09/08/2014 04:00 PM, Michael Catanzaro wrote:
This is a very big problem for the GNOME stack, which uses gnutls.
We're
getting complaints about sites that Epiphany can't display because the
CSS fails certificate validation, or sites that don't display at all,
which all work fine in Firefox.
Firefox also builds a repository of intermediate certificates over time
and uses them automatically to fill gaps in certificate chains for
completely unrelated sites. This leads to somewhat non-predictable
behavior regarding the set of sites to which Firefox can connect
reliably. This is difficult to emulate in one-shot command line tools
such as wget which do not keep any local state by default.
--
Florian Weimer / Red Hat Product Security