100386 - cert chain containing root cert overwrites trust

Status: VERIFIED WORKSFORME

(Core Graveyard :: Security: UI, defect, P1)

Description

[Christina Fu]

N6 2001091703

I imported cert chain from http://certificate.netscape.com and found the
existing root cert overwritten.  Here is how to verify:

0. create and start a new profile
1. [Manage Certificates] [Authorities] and note the GTE CyberTrust Root's serial
number and the fact that it's in Builtin Object Token.
2. go to http://certificate.netscape.com 
3. it tells you to import ca cert chain because of the N6 detection, import ca
and click the "email" one as instructed.
4. [Manage Certificates] [Authorities] and look for GTE CyberTrust Root again,
and you'll see that it now does not appear in Builtin Object Token, but rather
in Software Security Device (that's fine).

I expected to see that the "Intranet Certificate Authority" to be trusted, but
it's not.  Upon examination of the GTE CyberTrust Root, I noticed that it's no
longer trusted for most everything except for status. Users will have to
manually  click trust this cert again.

Before this is fixed, certificate.netscape.com might want to consider a ca cert
chain without the root cert (which presumably is already in most browsers, we
hope?), or, advice users on how to trust the root cert, again.

Comment 1

[Stephane Saux]

Talked to Relyea about this.  There could be something in the way
certificates.netscape.com is configured that could cause the cert to be
replaced. Baring this we should detect that we have the root cert already and
not cause it to be replaced. This may have been introduced by the fix to bug 91407
->javi

Comment 2

[Stephane Saux]

t->2.2

Comment 3

[Stephane Saux]

->kai

Comment 4

[Kai Engert [:KaiE:]]

I suggest to retest this now. I wanted to do it, but my understanding is, in
order to test this bug, I need to download the ca cert from that site.

When I use NS 6.21 or todays Mozilla build on that site, I don't see a link to
download it.

Does somebody know that link? Or can we assume the bug is now invalid?

Comment 5

[bill]

I removed the auto detection script because of all the complaining :)

You can get the CA cert chain manually by going to
https://certificates.netscape.com/GetCAChain.html (this can also be reached by
going to "get the server cert" and clicking on "get the AOL Intranet trusted
root cert")

Comment 6

[Kai Engert [:KaiE:]]

Ok, looks this bug is indeed fixed.

When I import the cert, I get the message "certificate already exists". After
that step, the certs are listed as being contained in the Software Security
Device. However, now they are still trusted.

Marking worksforme. Christina, please reopen the bug if you still see problems.

Comment 7

[John Unruh]

Verified fixed.