1229014 - PSM UI (certificate manager, etc.) does a poor job handling certificates with serial numbers over 20 bytes

Status: REOPENED

(Core :: Security: PSM, defect, P3)

Description

[mozilla]

Attachment: cert.b64

User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:42.0) Gecko/20100101 Firefox/42.0
Build ID: 20151030083518

Steps to reproduce:

1. Export CA from Novell eDirectory (Novell Open Enterprise 2015)
2. Imported CA to Authorities (see cert.b64).
3. Called "Edit Trust".
4. Enabled "This certificate can identify websites.", "This certificate can identify mail users." and "This certificate can identify software makers".


Actual results:

After clicking the "OK"-Button nothing happen. The window still keeps open. The settings will not be saved.


Expected results:

Trust settings should be saved.

Comment 1

[Michelle Funches - QA]

20151029151421
Mozilla/5.0 (X11; Linux x86_64; rv:42.0) Gecko/20100101 Firefox/42.0
@Reporter: I did not experience any errors in Adding or Editing CAs. Are you still experiencing this issue?

Comment 2

[mozilla]

Did you try importing the ca I attached (cert.b64)? You will be ablte to import this cert, but you cannot set any trustees.

Comment 3

[Michelle Funches - QA]

@Reporter, Confirmming: 
1) Linux: cert.b64 > Organizational CA/TREE_OESAPP does not import correctly "Import Failed: The password or PIN is incorrect. 
2) Windows 10:  this same cert appears to import but I cannot Edit Trust settings as stated.

Setting to Reopen and I will find appropriate Product/Component.

Comment 4

[mozilla]

What do you mean with "Linux"? Firefox under Linux or central Linux ca storage?

On Ubuntu 15.10 with Firefox 42 I cannot see any difference to the windows one.

Comment 5

[mozilla]

I can successfully import the CA to global Windows and Linux System.

Comment 6

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

That certificate has a serial number that is 36 bytes. Parts of NSS deliberately don't handle certificates with serial numbers longer than 20 bytes because RFC 5280 doesn't require conforming implementations to do so. PSM does a very poor job informing the user that this is the underlying issue. See also bug 1139205.

Comment 7

[mozilla]

David, thanks a lot for the explanation.
I'll tell Novell this issue and hope they'll fix it.

Regards