How do I know that notary servers are blocked on my firewall?

Question

If I enable Convergence I get these warnings. How can I know that my firewall blocks the communication with the notary servers? How can I test it under Linux? (Ubuntu 10.04 LTS)

I tried to add several notary servers, but it's the same.. :\

p.s.: can someone create a tag called: "convergence" ? - ty!

UPDATE: I use Firefox 11 on Ubuntu 10.04 LTS. If it's a bug, then is Firefox 11 affected?

Answer 1

It seems like this is a known bug : Issue #28 Notary fails for sites relying on SNI.

The description of it is :

Convergence will currently give a certificate error for sites using SNI to provide appropriate certificates for virtual hosts; it looks like this will magically fix itself once Twisted supports SNI.

Understanding where the problem lies takes some doing, tracking down all the links to all the bug tickets this bug report is linking to. Apparently this requires SNI support in PyOpenSS, meaning on the server side, so that github.com must also update its website's software.

SNI is short for Server Name Indication, defined by wikipedia as :

a feature that extends the SSL and TLS protocols to indicate what hostname the client is attempting to connect to at the start of the handshaking process. By doing so it allows a server to present multiple certificates on the same IP address and port number and hence allows multiple secure (HTTPS) websites to be served off the same IP address without requiring all those sites to use the same certificate.

Unfortunately to make use of SNI practical it is necessary that the vast majority of users are using web browsers that support it. Users whose browsers do not support SNI will be presented with a default certificate and hence are likely to receive certificate warnings. As of 2012 there are still many users of browsers that do not support SNI.

You should first ensure that you are using the latest version of Firefox.

If this is not enough, you will need to wait for all the software on both server sites and client software to correctly support SNI.

Answer 2

If it is a bug causing it, as stated above by @harrymc, then you should try to install the alpha release of Firefox (it is named Aurora).

Answer 3

_{(Here is another answer, because I might have misunderstood your problem with my first answer.)}

You can verify whether your computer can get to a particular server and port by doing something like :

telnet notary-us.convergence.qualys.com 80
telnet notary-us.convergence.qualys.com 443

Issue this command from a Command Prompt (cmd). If you manage to connect, press Enter a few times to convince the server on the other side to cut the connection.

If the firewall blocks the connection, you will simply have no connection with the server. I don't really expect this to happen with all the servers in your list. I had success with the above server on both ports 80 and 443.

In my tests some of the servers didn't answer, so it looked as if these servers were dead (for example notary.toughtcrime.org). Cutting out the dead servers might improve the situation.