Pidgin prompts for certs over and over

jaymzh · October 8, 2024, 4:30am

Note: I tried to file an Issue, but YouTrack says I don’t have permission.

Pidgin is constantly prompting me to accept certs for the same names over and over again (b-api(dot)facebook(dot)com, graph(dot)facebook(dot)com, mqtt(dot)facebook(dot)com, scontent(dot)facebook(dot)com).

While I’m only connecting to those because of the FB plugin, this seems to be a problem with the core Pidgin/libpurple code, which is why I’m posting here.

I got a debug log with the relevant parts posted on a Gist since Discourse says it’s “too many links” otherwise, but everytime it happens the log looks like this:

gist.github.com

https://gist.github.com/jaymzh/2312ff3e96b2246feeedcfd3f70d22e6

gistfile1.txt

(21:19:14) proxy: Connecting to graph.facebook.com:443 with no proxy
(21:19:14) proxy: Connection in progress
(21:19:14) proxy: Connecting to graph.facebook.com:443.
(21:19:14) proxy: Connected to graph.facebook.com:443.
(21:19:14) nss: SSL version 3.3 using 128-bit AES-GCM with 128-bit AEAD MAC
Server Auth: 256-bit ECDSA, Key Exchange: 256-bit ECDHE, Compression: NULL
Cipher Suite Name: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
(21:19:14) nss: subject=CN=*.facebook.com,O="Meta Platforms, Inc.",L=Menlo Park,ST=California,C=US issuer=CN=DigiCert SHA2 High Assurance Server CA,OU=www.digicert.com,O=DigiCert Inc,C=US
(21:19:14) nss: partial certificate chain
(21:19:14) certificate/x509/tls_cached: Starting verify for graph.facebook.com

This file has been truncated. show original

It’s unclear to me why, after I accept these certs, I get prompted again… my only guess is that different parts of FB’s infra have different (valid) certs.

I’ve looked at these certs and they are indeed valid, issued by digicert, though if I put the Issuer line here, Discourse won’t let me post so I’ll put the whole cert in the gist above.

Help?

jaymzh · October 8, 2024, 11:51pm

After authing to YouTrack via GH instead of username/password, I was able to create Issues: https://issues.imfreedom.org/issue/BIRB-5/Pidgin-prompts-for-valid-digisign-certs-over-and-over