209356 - Loading personal certificates

Status: RESOLVED FIXED

(Core Graveyard :: Security: UI, defect)

Description

[Graham]

User-Agent:       Mozilla/5.0 (OS/2; U; Warp 4.5; en-US; rv:1.4) Gecko/20030529
Build Identifier: Mozilla/5.0 (OS/2; U; Warp 4.5; en-US; rv:1.4) Gecko/20030529

In Mozilla 1.3 (os.2) I could apply for a free digital certificate successfully.
(eg Thawtes) but with Mozilla V1.4, when I apply for a new free certificate, the
following error appears

<No SPKAC received. What browser are you using?>

NB This was *Not* a problem with V1.3



Reproducible: Always

Steps to Reproduce:
1.
2.
3.



Expected Results:  
loaded my free digitial certificate into my  security/ certificates area

Comment 1

[Matthias Versen [:Matti]]

Why should this be a security hole ?

-> PSM (for crypto, certificates etc..)

Comment 2

[Mike Kaply [:mkaply]]

Please give a website where you did this.

Comment 3

[Graham]

Hello Mike

its hard to give you access to the web site but the free digital certificate
site for Thawtes is


http://www.thawte.com/html/COMMUNITY/index.html


where you must then register and log in and then go through a complex
registration then apply for a free certificate which is  specific for 

an email address
for the actual browser that was used to apply for the certificate...


so unless you want to go through that process  (will take you 15 minutes) its
hard  to be more specific.


I did send an email to Thawte support and they repliied that they had tested
their product with Mozilla V1.3 (and it works even with the OS.2 version!!) but
had not tested it with V1.4 yet

Comment 4

[Mike Kaply [:mkaply]]

The "Creating a private key" dialog stays up a LONG time and then you get the
error on the web page.

On Windows, the private key is created immediately.

Julian, any ideas?

Comment 5

[Mike Kaply [:mkaply]]

This is an optimizer bug. We are investigating.

Comment 6

[Mike Kaply [:mkaply]]

Attachment: Don't optimize pk11skey.c

Comment 7

[Mike Kaply [:mkaply]]

This is fixed on the 1.4 branch.

This was VACPP only, so there is no fix to put on the trunk unless Julian wants
to continue to have VACPP work for NSS.

Comment 8

[Graham]

Hi Mike and others

not being exactly clear on what this means , I presume that there is a fix in
the pipeline?

Graham

Comment 9

[Mike Kaply [:mkaply]]

The 1.4 nightly builds already have this fix.

The official 1.4 will have this as well.

Comment 10

[Graham]

Hello Mike

thanks -  its just that I have installed the last 'nightly build' dated 2nd June
2003 by the way (!)-  you chaps must have long nights over there-  and it tells
me (from the Help Menu) that it is Mozilla 1.5a and the bug is still there!?

Comment 11

[Mike Kaply [:mkaply]]

That is a GCC build which has security problems.

We recommend you use the OS/2 1.4 builds.

1.4 will be released today or tomorrow.