1057517 - firefox 31 certificate verification blocks sites with expired certs

Status: RESOLVED DUPLICATE of bug 1034124

(Core :: Security: PSM, defect)

Description

[dgdruker]

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.143 Safari/537.36

Steps to reproduce:

Firefox 31 and Firefox 31 ESR both refuse to go to a site with an expired server certificate.:

Secure Connection Failed

An error occurred during a connection to 10.66.118.152. Issuer certificate is invalid. (Error code: sec_error_ca_cert_invalid)

Yes, I know know the cert should be renewed, but this site is built for internal use only using third-party software and we cannot update the certificate.

I tried setting security.use_mozillapkix_verification to false, but this does not affect the error. You need a config setting to disable this check or create an exception. 

When I try to create an exception in Options, View Certificates, Servers, the browser says "Unable to obtain identification status for the given site.

This site works in Chrome, IE, Safari (after acknowledging self-signed cert.)


Actual results:

Secure Connection Failed

An error occurred during a connection to 10.66.118.152. Issuer certificate is invalid. (Error code: sec_error_ca_cert_invalid)



Expected results:

Browser should have presented certificate warning.

Comment 1

[Loic]

Is a dupe of bug 1047071?

Comment 2

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

I suspect this will end up being fixed by bug 1034124. Reporter, after bug 1034124 lands in Nightly, can you re-test and see if the problem is solved? Thanks.

Comment 3

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

I'm going to go ahead and assume this was fixed by bug 1034124.