SeaMonkey 2.0 and SSL

Yesterday I downloaded a nightly-build of SeaMonkey so I could see how things are going. It's functional, I think most of the updates are on the mail side which I haven't tried. I like it as a browser anyway.

Looking at the what's new list there are a few things that stand out:
  • Making the Extension environment more Firefox like
  • Making the rendering engine more Firefox like
  • Migration from Thunderbird
  • Add-On notification, like Firefox
And something they didn't point out...
  • Complain about un-chained SSL certificates like Firefox.
I could have sworn I've griped about this before, but I can't find the post. Here in the land of IT, vendors of all kinds ship web interfaces with self-signed SSL certificates. Generally speaking this is just fine, since these are appliances/applications/interfaces that a VERY small group of people have access to, and any SSL is better than none. Chaining to a trusted CA isn't as important since I very likely manage the box/widget/app myself and trust it. But Firefox (and now SeaMonkey 2.0) gripes about it, since it is, technically, unsafe.

Yes, I can add exceptions. This works for things with a static file. But for certain other things, such as HP Integrated Lights Out boards, regenerate their SSL certificates every time they power-cycle, forcing you to re-add the exception every time that server reboots. For these, adding exceptions doesn't work. In my line of work, I must have umpty hundreds of little SSL-enabled web-pages all over the place.

NetWare, at least last time I checked, defaulted to using the IP-certificate instead of the DNS-certificate for the Novell Remote Monitor. Since I never access that with an IP address, this will trigger a gripe from Firefox as the Subject doesn't match what's in the URL bar. For this reason, and others, one of my post-install tasks is to change that to load the DNS certificate (and disable the Xserver, nfs, and afp servers).

When I'm doing a lot of work on systems with funky certificates, this can get downright aggravating. When I was doing work in the Novell Beta for OES2-SP1, I had a lot of test trees set up, with their own Certificate Authorities, and PKI environment. If I had been using Firefox for all of that, by now I'd have had A LOT of "Organizational CA" certificates in my browser root-cert store. Instead, I was lazy, used SeaMonkey, and just clicked past the gripes.

Since I have legitimate reason to be regularly hitting web-sites with bad SSL certificates, it would be really nice if there was some way to turn off the hard-stop warning FF (and now SM 2.0) come with, and go back to an earlier mode.

Also on my List? Vendors who don't allow anyway to update their pre-shipped SSL certificates. Grrrr.