682263 - Cannot validate the server's EE certificate when the server fails to send the intermediate certificate

Status: RESOLVED DUPLICATE of bug 657228

(Core :: Security: PSM, defect)

Description

[yuppicide138]

User Agent: Mozilla/5.0 (Windows NT 5.1; rv:6.0) Gecko/20100101 Firefox/6.0
Build ID: 20110811165603

Steps to reproduce:

Loaded firefox, tried to go to this website https://sterling.factoringsystem.com


Actual results:

When I go there it comes up with the message This Connection Is Untrusted. If I click Add Exception it says 

Valid Certificate

This site provides valid, verified identification. There is no need to add an exception.


Expected results:

My web page should have opened. I trust the website. I use it on a daily basis to enter orders. The company provides credit to customers. This works fine in Internet Explorer.

Comment 1

[Matthias Versen [:Matti]]

this is a server configuration problem as far as i can see and not a browser bug.
The server doesn't send the complete certificate chain as confirmed by http://www.sslshopper.com/ssl-checker.html#hostname=https://sterling.factoringsystem.com

You may want to read and send that to the page owner
-> https://wiki.mozilla.org/Incomplete_Certificate_Chain

Comment 2

[Dario Corti]

The same with my corporate webmail. In certificate details firefox says that it's for the correct site (webmail.<biggesteuropeancorp>.it, in error details it says that certificate is only valid for *.opendns.com, opendns.com.

Comment 3

[Dario Corti]

This could even be a site config issue (I can't see how... it's ff that tries to apply the certificate to the wrong domain), but it should be possible to add an exception, anyway. You can't say certificate error on one side and certificate valid on the exception form.

Comment 4

[Dario Corti]

Oops. Ignore me, I realized that the domain had dns issues and opendns is nagging firefox.

Comment 6

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

The original problem report was not about adding an exception, but rather the inability of Firefox to be able to validate the EE certificate while IE can. As noted above, the server is misconfigured; it doesn't send the intermediate certificate in its Certificates message. Possible solutions are bug 399324 and bug 657228.

The most likely reason for not being able to add a security exception is being tracked in bug 659736.