1016420 - Troubles testing new Certificate Verification library (mozilla::pkix) Camerfirma EV Certificates

Status: RESOLVED INVALID

(Core :: Security: PSM, defect)

Description

[Ramiro Muñoz Muñoz]

Attachment: screenshots with pkix on and off

User Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36

Steps to reproduce:

I've tried our EV Certificates (e.g. https://plat.nestwork.eu or https://plusvalias.mazarron.es/ ) using the new certificate verification library (mozilla::pkix). (security.use_mozillapkix_verification true)


Actual results:

Firefox shows them as OV Certificates (without the green bar)


Expected results:

Firefox must show them as EV certificates (with the green bar)

Comment 1

[Kathleen Wilson]

Bug #991815 is probably the reason these sites are not getting EV treatment with mozilla::pkix.

Ramiro, it looks like https://plat.nestwork.eu does not send out the intermediate certificate with the SSL cert. It results in the Untrusted Connection error until after I've browsed to the other site. Then it works. Please get the server updated with the intermediate cert.

Comment 2

[Ramiro Muñoz Muñoz]

Hi Kathleen,

We've modified our OCSP responder. Now we obtain the right behaviour using our EV certificates with PKIX.

Thank you for your help.