653565 - Review when and when not to call cancel_and_failure for certificate validation errors

Status: RESOLVED WORKSFORME

(Core :: Security: PSM, enhancement)

Description

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

+++ This bug was initially created as a clone of Bug #479393 +++

> > We're supposed to avoid calling cancel_and_failure() here, because we didn't
> > set up an alternative way of reporting the error, right?

> This does the same as the other fatal error scenarios (see remainder of that
> function).
> Unless we decide to rewrite this function to deal differently with unexpected
> failures (would have to be done in a separate bug), this change is consistent
> with the remainder of the function.

Comment 1

[Kai Engert (:KaiE:)]

Brian and I think this does not block "switch to pkix by default", but it should be fixed soon; moving it to a tracker bug for major PKIX related issues.