Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

If I enable Convergence I get these warnings. How can I know that my firewall blocks the communication with the notary servers? How can I test it under Linux? (Ubuntu 10.04 LTS)

I tried to add several notary servers, but it's the same.. :\

enter image description here

p.s.: can someone create a tag called: "convergence" ? - ty!

UPDATE: I use Firefox 11 on Ubuntu 10.04 LTS. If it's a bug, then is Firefox 11 affected?

share|improve this question
    
It may be that my answer from Jan 23 doesn't apply. Do you use a proxy in your browser (Issue #124 and Issue #128) ? –  harrymc Apr 6 '12 at 14:07
    
No, I don't use a proxy. –  LanceBaynes Apr 7 '12 at 20:04

3 Answers 3

It seems like this is a known bug : Issue #28 Notary fails for sites relying on SNI.

The description of it is :

Convergence will currently give a certificate error for sites using SNI to provide appropriate certificates for virtual hosts; it looks like this will magically fix itself once Twisted supports SNI.

Understanding where the problem lies takes some doing, tracking down all the links to all the bug tickets this bug report is linking to. Apparently this requires SNI support in PyOpenSS, meaning on the server side, so that github.com must also update its website's software.

SNI is short for Server Name Indication, defined by wikipedia as :

a feature that extends the SSL and TLS protocols to indicate what hostname the client is attempting to connect to at the start of the handshaking process. By doing so it allows a server to present multiple certificates on the same IP address and port number and hence allows multiple secure (HTTPS) websites to be served off the same IP address without requiring all those sites to use the same certificate.

Unfortunately to make use of SNI practical it is necessary that the vast majority of users are using web browsers that support it. Users whose browsers do not support SNI will be presented with a default certificate and hence are likely to receive certificate warnings. As of 2012 there are still many users of browsers that do not support SNI.

You should first ensure that you are using the latest version of Firefox.

If this is not enough, you will need to wait for all the software on both server sites and client software to correctly support SNI.

share|improve this answer
    
I can't visit any HTTPS site. are you sure this could be the problem? don't think so. –  LanceBaynes Jan 26 '12 at 3:07
    
One can never be sure what a problem is from a distance, but it sure looks this way. –  harrymc Jan 30 '12 at 19:20

If it is a bug causing it, as stated above by @harrymc, then you should try to install the alpha release of Firefox (it is named Aurora).

share|improve this answer

(Here is another answer, because I might have misunderstood your problem with my first answer.)

You can verify whether your computer can get to a particular server and port by doing something like :

telnet notary-us.convergence.qualys.com 80
telnet notary-us.convergence.qualys.com 443

Issue this command from a Command Prompt (cmd). If you manage to connect, press Enter a few times to convince the server on the other side to cut the connection.

If the firewall blocks the connection, you will simply have no connection with the server. I don't really expect this to happen with all the servers in your list. I had success with the above server on both ports 80 and 443.

In my tests some of the servers didn't answer, so it looked as if these servers were dead (for example notary.toughtcrime.org). Cutting out the dead servers might improve the situation.

share|improve this answer
    
pastebin.com/raw.php?i=JgvPeTMG So it looks like I can connect to the notary servers, but it gives an error if I try the "GET" command. –  LanceBaynes Apr 13 '12 at 12:43
    
I don't know the protocol used by notary servers, but for http the GET command needs a URL parameter. I think the conclusion is that your firewall doesn't block outgoing connections to the notary servers, so the problem is not in the firewall but in the Convergence add-on itself. –  harrymc Apr 13 '12 at 13:17

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.