1175124 - Importing a cert immediately after deleting it in the cert mgr does not work

Status: RESOLVED DUPLICATE of bug 435159

(Core :: Security: PSM, defect)

Description

[Ikonta]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Firefox/31.0
Build ID: 20150525110815

Steps to reproduce:

I use amd64 Gentoo build of www-client/firefox-31.7.0.
To reproduce this issue you need CA certificate and three client certificates, vrified by this CA.

First time: start FF and import two of client certificates.
After that quit FF and start it again.
Goto certificate manager, remove one of previously imported certificates and import the rest one.


Actual results:

After typing passphrase I've seen apeeared not only the imported certificate item, but also the deleted one!


Expected results:

I expect, just imported certificate appear into list, without returning deleted one.

P.S. Cache cleane probably will be a workaround.

Comment 1

[Ikonta]

Issue was confirmed in recent ESR (38.2.1).

Comment 2

[Loic]

Any public CA certificate and three client certificates to test that?

Comment 3

[Ikonta]

AFAIK _restricted_ (!) client certs are incompatibe with public CA model. I don't work with Webmoney (and I don't know other widely known public service, which uses client certificate authentication), but AFAIK even then Certification Authority uses some kind of custom CA certificate.
Maybe by issuing intermediate CA… But it stays question about CRL.
I can attach example certs files or, better, because generated by different versions of OpenSSL certs differ (gnutls not tested at all yet), to describe procedure somewhere in wiki or better in forum (somebody who knows English better is welcome to mergi it into wiki).

But just now I've find another way to check this bug:
1. Import CA or start FF with imported example test CA certificate. You can get any of such, for example from bug #1202636.
2. Delete this CA certificate.
3. Try to import it again.
After step 3 you'll get error message "certificate already imported", although it is not only imported, but already deleted.

Comment 4

[Ikonta]

Attachment: ca.crt

Attaching chain's root (custom CA) to show originally described issue.

Comment 5

[Ikonta]

Attachment: user1.pfx

First user's certificate.
PIN — 0000

Comment 6

[Ikonta]

Attachment: user2.pfx

Second user's certificate.
PIN — 0000

Comment 7

[Ikonta]

Attachment: user3.pfx

Third user's certificate.
PIN — 0000

Comment 8

[:Cykesiopka]

Thanks for filing the report. This looks like the same basic issue described in Bug 435159.