cert chain containing root cert overwrites trust

VERIFIED WORKSFORME

Status

Core Graveyard
Security: UI
P1
normal
VERIFIED WORKSFORME
16 years ago
9 months ago

People

(Reporter: Christina Fu, Assigned: kaie)

Tracking

1.0 Branch
psm2.2
x86
Windows 2000

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

16 years ago
N6 2001091703

I imported cert chain from http://certificate.netscape.com and found the
existing root cert overwritten.  Here is how to verify:

0. create and start a new profile
1. [Manage Certificates] [Authorities] and note the GTE CyberTrust Root's serial
number and the fact that it's in Builtin Object Token.
2. go to http://certificate.netscape.com 
3. it tells you to import ca cert chain because of the N6 detection, import ca
and click the "email" one as instructed.
4. [Manage Certificates] [Authorities] and look for GTE CyberTrust Root again,
and you'll see that it now does not appear in Builtin Object Token, but rather
in Software Security Device (that's fine).

I expected to see that the "Intranet Certificate Authority" to be trusted, but
it's not.  Upon examination of the GTE CyberTrust Root, I noticed that it's no
longer trusted for most everything except for status. Users will have to
manually  click trust this cert again.

Before this is fixed, certificate.netscape.com might want to consider a ca cert
chain without the root cert (which presumably is already in most browsers, we
hope?), or, advice users on how to trust the root cert, again.

Comment 1

16 years ago
Talked to Relyea about this.  There could be something in the way
certificates.netscape.com is configured that could cause the cert to be
replaced. Baring this we should detect that we have the root cert already and
not cause it to be replaced. This may have been introduced by the fix to bug 91407
->javi
Assignee: ssaux → javi
Priority: -- → P1
Target Milestone: --- → Future
Version: 1.3 → 2.1

Comment 2

16 years ago
t->2.2
Status: UNCONFIRMED → NEW
Ever confirmed: true
Target Milestone: Future → 2.2

Comment 3

16 years ago
->kai
Assignee: javi → kaie
(Assignee)

Comment 4

16 years ago
I suggest to retest this now. I wanted to do it, but my understanding is, in
order to test this bug, I need to download the ca cert from that site.

When I use NS 6.21 or todays Mozilla build on that site, I don't see a link to
download it.

Does somebody know that link? Or can we assume the bug is now invalid?

Comment 5

16 years ago
I removed the auto detection script because of all the complaining :)

You can get the CA cert chain manually by going to
https://certificates.netscape.com/GetCAChain.html (this can also be reached by
going to "get the server cert" and clicking on "get the AOL Intranet trusted
root cert")
(Assignee)

Comment 6

16 years ago
Ok, looks this bug is indeed fixed.

When I import the cert, I get the message "certificate already exists". After
that step, the certs are listed as being contained in the Software Security
Device. However, now they are still trusted.

Marking worksforme. Christina, please reopen the bug if you still see problems.
Status: NEW → RESOLVED
Last Resolved: 16 years ago
Resolution: --- → WORKSFORME

Comment 7

16 years ago
Verified fixed.
Status: RESOLVED → VERIFIED

Updated

13 years ago
Component: Security: UI → Security: UI
Product: PSM → Core

Updated

9 years ago
Version: psm2.1 → 1.0 Branch
Product: Core → Core Graveyard
You need to log in before you can comment on or make changes to this bug.