1037654 - Firefox fails to validate SSL the certificate for the www.bced.gov.bc.ca domain

Status: RESOLVED INVALID

(Firefox :: Untriaged, defect)

Description

[tech]

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:30.0) Gecko/20100101 Firefox/30.0 (Beta/Release)
Build ID: 20140605174243

Steps to reproduce:

I went to this URL: https://www.bced.gov.bc.ca/eassessment/eexams.htm


Actual results:

I arrived at the "This Connection is Untrusted" page. Under "Technical Details", the following three lines appeared (verbatim):
www.bced.gov.bc.ca uses an invalid security certificate.
The certificate is not trusted because no issuer chain was provided.
(Error code: sec_error_unknown_issuer)



Expected results:

I should have arrived at the B.C. government's e-Exams website.

Comment 1

[tech]

The certificate for www.bced.gov.bc.ca is currently valid (as of July 11, 2014 2:17PM -0700). The certificate hierarchy is as follows:

Entrust.net Certification Authority (2048)
|--> Entrust Certification Authority - L1C
     |--> www.bced.gov.bc.ca

There are no problems validating the cert in Internet Explorer (v.9.0). 

I have found some computers (inexplicably) where Firefox 30.0 does correctly validate the cert.

The following are remedial actions I have already tried:

* Reset Firefox
* Restart Firefox with addons disabled
* Uninstall Firefox (keeping settings), and reinstall Firefox.
* Uninstall Firefox (deleting all user settings), and reinstall Firefox.
* Completely uninstall Firefox (as per http://kb.mozillazine.org/Uninstalling_firefox), and reinstall Firefox.
* Turned off proxy (Options->Advanced->Network->Connection Settings...->No proxy)

Comment 2

[tech]

Sorry, the title for this bug should be "Firefox fails to validate the SSL certificate for the www.bced.gov.bc.ca domain".

Comment 3

[Dave Garrett]

https://www.ssllabs.com/ssltest/analyze.html?d=bced.gov.bc.ca

Path #1: Trusted
1 	Sent by server 	www.bced.gov.bc.ca
SHA1: aec3817c5e95b96152bcd9bfb943c1b8d0490b64
RSA 2048 bits / SHA1withRSA
2 	Extra download 	Entrust Certification Authority - L1C
SHA1: c53e73073f93ce7895de7484126bc303dab9e657
RSA 2048 bits / SHA1withRSA
3 	In trust store 	Entrust.net Certification Authority (2048)
SHA1: 503006091d97d4f5ae39f7cbe7927d7d652d3431
RSA 2048 bits / SHA1withRSA 

Trusted, but with "extra download" required to get cert in the chain. This is probably the issue, but I'm not an expert on the topic so I don't know how to fix that off-hand.

Comment 4

[Dave Garrett]

My current profile can view the site, but a new one cannot. (using current Aurora on Linux) No idea how it got the cert(s) needed for this, as I don't actually know enough of how this part of the authentication process works myself. Nonetheless, this seems to be where the issue likely is.

Comment 5

[:Gijs (he/him)]

The certificate chain is incomplete. That's an issue with the server's configuration. See e.g. http://www.sslshopper.com/ssl-checker.html#hostname=www.bced.gov.bc.ca


Instructions on how to fix from entrust: http://www.entrust.net/ssl-technical/webserver.cfm .