[pl4nty]

Problem

https://www.commbank.com.au/digital/home-buying/calculator/home-loan-repayments times out after about 30 s with GeckoView:OnLoadError.

Root cause

• www.commbank.com.au sends an optional TLS CertificateRequest (openssl s_client shows "Acceptable client certificate CA names"). www.my.commbank.com.au and the other CommBank hosts do not.
• Gecko asks the app through PromptDelegate.onRequestCertificate. Candy answered with prompt.dismiss(), which resolves the prompt with a null result.
• ClientAuthDialogService.sys.mjs then reads result.alias and throws (TypeError: can't access property "alias", result is null, seen in logcat). Because of that, callback.certificateChosen is never called and the TLS handshake stalls.

Fix

Answer with prompt.confirm(null). CertificateRequest.confirm documents a null alias as "no certificate selected", so the handshake continues without a client certificate. This is the same behaviour as before for sites that require a certificate: those sites still reject the connection. Candy never offered a KeyChain picker.

Testing

Tested on an emulator (API 35, debug build, GeckoView 157), although there were some extra patches applied:

• Before the fix: PageStart, then Prompt, then the ClientAuth TypeError, then OnLoadError about 30 s later. The tab stays at about:blank.
• After the fix: PageStart, then Prompt, then PageStop after about 5 s, with no error. The calculator renders.

[sk2andy]

Reviewed the one-line change against the GeckoView 159 API and bundled ClientAuthDialogService. confirm(null) correctly returns an explicit null alias without selecting a client certificate. An isolated check of the original callback reproduces the TypeError with the old null response and reaches certificateChosen with the new response. No blocking findings. Both CI checks passed. Android build and live CommBank navigation were not rerun during this review.