How to preserve SSL with HTML5 application cache

Question

I have an existing site that works fine over http and https (SSL). The SSL certificate is valid and can be confirmed by inspecting in the browser.

I am starting to use a manifest file to enable the HTML5 application cache on my website. This is useful for making the page load faster, and eventually for offline capabilities. This is working great when using a regular http connection. The problems happens when accessing the site over https (SSL). When I do this, I can access my website's content just fine, and the URL says "https" however I see the following behavior:

Safari: It displays the lock icon, but when I click the lock icon to inspect the certificate, it says that the certificate is invalid.

Firefox: Does not display the colored address bar indicating encryption, and when inspecting the certificate, it says that there is no certificate.

Chrome and Opera: Correctly displays the secure nature of the URL, and when clicking the lock icon it displays the SSL certificate information. Yes!

I understand that using the application cache causes resources to be served locally from the browser, and as such there is no encryption happening, however customers don't necessarily know that there is an application cache happening in the background, and they are expecting to see a valid SSL certificate and indications that the connection is secure. Safari and Firefox appear to be doing this incorrectly, unless I am missing something. That is my question. Does anyone know how to get Safari and Firefox to display the SSL certificate for pages served from the application cache? Is there something special that you need to do, or is it a Safari and Firefox bug?

Whop

So, did you come up with any solution? – Borosilicate

I have not found a solution. As far as I know, these are Safari and Firefox bugs. – Whop

Answer 1

I believe someone has discussed this with me before. Please let me know if this helps.

Change all of your script and css references from http:// or https:// to //.

If you haven't any then it is moot, but if you do, please let me know if that has an effect.

I believe this may be related to not being able to verify the references from a cached page.

Drum

Answer 2

Based on the history of vulnerabilities, I'd guess this may have been overlooked for the sake of fixing more critical issues. That said, I think this should be reported to both vendors now that some of the glaring vulnerabilities have been patched. Have you tested this with the latest releases of Firefox and Safari?

Maceio

Answer 3

Did you serve the application manifest over SSL?

Julejulee