106745 - Need to check S/MIME certificate issued by an untrusted CA

Status: VERIFIED FIXED

(MailNews Core :: Security: S/MIME, defect, P1)

Description

[Antonio Lam]

Build: 2001-10-24-14-OTIS commercial build

The current S/MIME implementation didn't check for error if the S/MIME cert 
was issued by an untrusted CA.

Step to reproduce:

1. Obtain a test cert (sectest) from certificate.netscape.com
2. Go to Certificate Manager|Authorities
3. Edit the "Intranet Certificate Authority" CA by uncheking all the trust 
settings.
4. Make sure the Root CA "GTE Cyber Trust Root" also has all trust setting 
unchecked (default setting)
5. Try to read a sign message with the cert issued by "Intranet Certificate 
Authority"

Note that the mail client pop up an alert dialog saying the sign message has a 
valid signature.

Comment 1

[Stephane Saux]

ddrinan

Comment 2

[Tom Mraz]

This is now fine. The text says <invalid signature> now.

Comment 3

[Antonio Lam]

confirmed with build: 
/u/kaie/mozilla-win32-nss34-20020201-115010-115209-122961.zip

Clicking on the <invalid signature> also gave me the correct reason why the 
signature is invalid (untrusted CA)

But I will wait until I also confirmed with the NSS 3.4 enabled mozilla trunk 
build before I marked this as fixed/verified.

Comment 4

[Stephane Saux]

S/MIME bugs are automatically nsbeta1 candidates. (this is a bulk update - there
may be some adjustment of the list).

Comment 5

[Stephane Saux]

kai

Comment 6

[Kai Engert [:KaiE:]]

Antonio, you said you wanted to wait with verifying. Now that NSS 3.4 is used,
can you please try again?

Comment 7

[John Unruh]

Verified.

Comment 8

[John Unruh]

Fixed.

Comment 9

[John Unruh]

Verified.