1147213 - Certificate revocation blocklist: last entry in list does not get blocked

Status: RESOLVED INVALID

(Core :: Security: PSM, defect)

Description

[Matt Wobensmith [:mwobensmith][:matt:]]

1. In Fx37, update your browser to point to the staging AMO site [1].
2. As above, force a download of the blocklist.
3. Navigate to https://uber.com.


Result:

Site loads.

Expected:

Site blocked.


We have been chasing this issue for a while and discovered that whatever entry is last on the list does not get blocked. A workaround could be to put a dummy value in the blocklist at the end.



[1] https://wiki.mozilla.org/Blocklisting/Testing

Comment 1

[Matt Wobensmith [:mwobensmith][:matt:]]

OK, wait a second. Now this is working as expected. 

I verified that the blocklist had been downloaded and that the revocations.txt file contained the entries for uber.com's cert. It did not block the site, hence this bug. However, I waited about 15 minutes and refreshed page, saw the site being blocked. Now I am baffled as to why.

Comment 2

[Mark Goodwin [:mgoodwin]]

Had you previously navigated to https://uber.com in this session?

If you had and you did not force-refresh, it may be reusing an existing connection (and thus cert would not be checked, so the error would not be seen). Might that have happened?

Comment 3

[Matt Wobensmith [:mwobensmith][:matt:]]

Yes, that is possible. 

I just did a clean test where the sites/certs blocked had never been accessed from this profile/browsing session before. Everything passed. Marking this invalid.