378221 - Web site certificate trust and CA certificate trust for www.bookmarksonline.org are mutually exclusive

Status: RESOLVED INVALID

(Core Graveyard :: Security: UI, defect)

Description

[Miriam Frenay]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.3) Gecko/20070309 Firefox/2.0.0.3
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.3) Gecko/20070309 Firefox/2.0.0.3

Editing the CA Trust settings for www.bookmarksonline.org, which certificate I know to have expired on 10/4/2007, resets the trust settings for the web site certificate to not trust its authenticity. An attempt to fix this by editing the web site trust settings again then clears the trust settings for the corresponding CA.

Reproducible: Always

Steps to Reproduce:
1. Open https://www.bookmarksonline.org/
2. In the dialog that appears click Continue.
3. In the following dialog, choose "Accept this certificate permanently" and click OK.
4. Go to Tools -> Options -> Advanced -> Encryption -> View Certificates -> Web Sites.
5. Select the certificate for www.bookmarksonline.org and click Edit.
6. Click "Edit CA Trust".
7. Check "This certificate can identify web sites." and click OK.
8. Click Edit again and notice that "Do not trust the authenticity of this certificate." is now selected.
9. Select "Trust the authenticity of this certificate.", and click OK.
10. Again, click Edit, followed by "Edit CA Trust". Notice that the checkbox that was checked in step 7 is now cleared.
Actual Results:  
Trusting the Certificate Authority clears the trust settings for the web site, and vice versa.

Expected Results:  
It should be possible to set the trust settings for the web site and the CA seperately.

I noticed that the behavior for www.bookmarksonline.org's certificate is a bit strange compared to others. When I click "Edit CA Trust" in the "Edit web site certificate trust settings" dialog, the "Edit CA certificate trust settings" replaces the former. Recognizing the issuer stated in the former dialog as an LDAP DN, I noticed that its structure is unusual as it starts with an email addres instead of the CN or OU. What's more, the CN is the same as the domain name, which is what I suspect Firefox is having a problem with.

Comment 1

[Carsten Book [:Tomcat]]

confirmed with Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.9a4pre) Gecko/2007042104 Minefield/3.0a4pre and Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.8.1.4pre) Gecko/2007042004 BonEcho/2.0.0.4pre

Also with a second Web Certificate 

Comment 2

[Kai Engert (:KaiE:)]

reassign bug owner.
mass-update-kaie-20120918

Comment 3

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

We removed the "Edit CA Trust" button.