cert chain containing root cert overwrites trust



Core Graveyard
Security: UI
16 years ago
11 months ago


(Reporter: Christina Fu, Assigned: kaie)


1.0 Branch
Windows 2000

Firefox Tracking Flags

(Not tracked)




16 years ago
N6 2001091703

I imported cert chain from http://certificate.netscape.com and found the
existing root cert overwritten.  Here is how to verify:

0. create and start a new profile
1. [Manage Certificates] [Authorities] and note the GTE CyberTrust Root's serial
number and the fact that it's in Builtin Object Token.
2. go to http://certificate.netscape.com 
3. it tells you to import ca cert chain because of the N6 detection, import ca
and click the "email" one as instructed.
4. [Manage Certificates] [Authorities] and look for GTE CyberTrust Root again,
and you'll see that it now does not appear in Builtin Object Token, but rather
in Software Security Device (that's fine).

I expected to see that the "Intranet Certificate Authority" to be trusted, but
it's not.  Upon examination of the GTE CyberTrust Root, I noticed that it's no
longer trusted for most everything except for status. Users will have to
manually  click trust this cert again.

Before this is fixed, certificate.netscape.com might want to consider a ca cert
chain without the root cert (which presumably is already in most browsers, we
hope?), or, advice users on how to trust the root cert, again.

Comment 1

16 years ago
Talked to Relyea about this.  There could be something in the way
certificates.netscape.com is configured that could cause the cert to be
replaced. Baring this we should detect that we have the root cert already and
not cause it to be replaced. This may have been introduced by the fix to bug 91407
Assignee: ssaux → javi
Priority: -- → P1
Target Milestone: --- → Future
Version: 1.3 → 2.1

Comment 2

16 years ago
Ever confirmed: true
Target Milestone: Future → 2.2

Comment 3

16 years ago
Assignee: javi → kaie

Comment 4

16 years ago
I suggest to retest this now. I wanted to do it, but my understanding is, in
order to test this bug, I need to download the ca cert from that site.

When I use NS 6.21 or todays Mozilla build on that site, I don't see a link to
download it.

Does somebody know that link? Or can we assume the bug is now invalid?

Comment 5

16 years ago
I removed the auto detection script because of all the complaining :)

You can get the CA cert chain manually by going to
https://certificates.netscape.com/GetCAChain.html (this can also be reached by
going to "get the server cert" and clicking on "get the AOL Intranet trusted
root cert")

Comment 6

16 years ago
Ok, looks this bug is indeed fixed.

When I import the cert, I get the message "certificate already exists". After
that step, the certs are listed as being contained in the Software Security
Device. However, now they are still trusted.

Marking worksforme. Christina, please reopen the bug if you still see problems.
Last Resolved: 16 years ago
Resolution: --- → WORKSFORME

Comment 7

16 years ago
Verified fixed.


13 years ago
Component: Security: UI → Security: UI
Product: PSM → Core


9 years ago
Version: psm2.1 → 1.0 Branch
Product: Core → Core Graveyard
You need to log in before you can comment on or make changes to this bug.