1275255 - some DATEV S/MIME certificates not accepted

Status: UNCONFIRMED

(Thunderbird :: Security, defect)

Description

[Stefan Jäger]

Attachment: Bad_and_OK.zip

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0
Build ID: 20160502172042

Steps to reproduce:

I did try to import S/mime certivicates from DATEV into Thunderbird

I did download the certivicate at:
http://www.crl.esecure.datev.de/ENCAUT/ENC/suche.php
Enter e.g. "[e-mail]" as Email and Press "senden"

So you get a link to the user and Root(CA) certivicate





Actual results:

I could Import the Root /CA certivicate in Thunderbird at "Authorities" => OK

When I try to import the User Cert at the the "Peoble" tab
I get the MSG:
"This certificate can't be verified and will not be imported. The certificate issuer might be unknown or untrusted, the certificate might have expired or been revoked, or the certificate might not have been approved."

It is also not possible to import this cert in firefox


Expected results:

It should be possible to Import this Cert:

This is possible E.g.:
* With Chrome
* With MS Outlook

Also some other Certs from DATEV do work fine with Thunderbird

E.G. the one of the Email adress "[e-mail]"
(you can get it at the same page told above)

mention: It uses an other Root/CA Cert ("CA DATEV STD 03" instead of "CA DATEV STD 02")