1007076 - mozilla::pkix cannot connect to mail.aol.com and various other sites

Status: RESOLVED WORKSFORME

(Core :: Security: PSM, defect)

Description

[iii_iii]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:32.0) Gecko/20100101 Firefox/32.0 (Beta/Release)
Build ID: 20140506030204

Steps to reproduce:

Go to https://mail.aol.com or https://my.screenname.aol.com with security.OCSP.require;true and security.use_mozillapkix_verification;true



Actual results:

An error occurred during a connection to mail.aol.com. The OCSP server experienced an internal error. (Error code: sec_error_ocsp_server_error) 


Expected results:

Secure connection to aol. Switching pkix off results in secure connection to aol.

The server is ocsp.verisign.com. I can see there is another bug about old certificates, but the error message here is different.

Comment 1

[iii_iii]

Another example:

https://esta.cbp.dhs.gov/

Comment 2

[iii_iii]

Another example:

https://ais.usvisa-info.com/en-es/niv

Comment 3

[Paul Silaghi, QA [:pauly]]

Confirmed in 32.0a1 (2014-05-07), Win 7 x64

Comment 4

[iii_iii]

Another

https://www.foreverliving.com/

Comment 5

[:Cykesiopka]

Is this still an issue? All of these sites work for me on Aurora 38 security.OCSP.require = true.
(mozilla::pkix is the only option starting in Firefox 33, so security.use_mozillapkix_verification is meaningless past Firefox 32.)

Comment 6

[:Cykesiopka]

(In reply to Cykesiopka from comment #5)
> Is this still an issue? All of these sites work for me on Aurora 38
> security.OCSP.require = true.

... on Aurora 38 with security.OCSP.require set to true.

Comment 7

[:Cykesiopka]

Hi,

I just wanted to give a friendly ping with regards to the ni? request from comment 5.

Thanks!

Comment 8

[iii_iii]

I can access the sites with OCSP.require set to true, on Firefox 38. So if pkix is on by default now, then it is no longer an issue.

Comment 9

[:Cykesiopka]

(In reply to iii_iii from comment #8)
> I can access the sites with OCSP.require set to true, on Firefox 38. So if
> pkix is on by default now, then it is no longer an issue.

As mentioned in comment 5, mozilla::pkix has been the only option since Firefox 33.
Thanks for checking!