122967 - Editing trust of another person's cert must set correct trust

Status: VERIFIED FIXED

(MailNews Core :: Security: S/MIME, defect, P1)

Description

[Kai Engert (:KaiE:)]

Make sure you have a cert in certificate manager other's tab, that is not trusted.
Use the edit button and explicitly trust that cert.
After you do that, signed emails from that person are still untrusted.
Expected behaviour: Signed email should be trusted after that action.

I think the reason is that manual edit adds the wrong trust bits. If you view
the details of that cert, it says "cert has been verified for usage as SSL
Server", which is not what we want.

Comment 1

[Kai Engert (:KaiE:)]

-> me

Comment 2

[Stephane Saux]

Not to say that there isn't a bug here, but ssl server is displayed as a
combination of the keyusage and the extended key usage, both of which are set in
the cert (not editable).
Newer certs from the intranet CA were tweaked to issue the correct extenstion in
extended key usage so that the cert manager would not display ssl server (It did
before)

Comment 3

[Stephane Saux]

S/MIME bugs are automatically nsbeta1 candidates. (this is a bulk update - there
may be some adjustment of the list).

Comment 4

[Kai Engert (:KaiE:)]

I would like to make this nsbeta1+, because I think the fix will be very simple.

At least, we should remove the edit button from the other's tab.

Comment 5

[Kai Engert (:KaiE:)]

Attachment: Suggested temporary fix

This patch removes the edit trust button from the email certs tab.

Comment 6

[Kai Engert (:KaiE:)]

Javi, can you please review?

As long as editing trust of email addresses is not implemented correctly, we
should not display the edit button. This patch removes the edit button for now.

Comment 7

[Javier Delgadillo]

r=javi

Comment 8

[Kai Engert (:KaiE:)]

Alec, can you please review the deactivation of a button in XUL (until we
implement it correctly some time in the future).

Comment 9

[Alec Flett]

Comment on attachment 75967 [details] [diff] [review]
Suggested temporary fix

sr=alecf

Comment 10

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Comment on attachment 75967 [details] [diff] [review]
Suggested temporary fix

a=roc+moz

Comment 11

[Kai Engert (:KaiE:)]

Temporary patch checked in.
Removing nsbeta1+.

Bug stays open until the feature gets implemented.

Comment 12

[Stephane Saux]

adding nsbeta1-
as a reminder.

Comment 13

[Stephane Saux]

cc cotter

Comment 14

[Kai Engert (:KaiE:)]

*** Bug 130481 has been marked as a duplicate of this bug. ***

Comment 15

[Asa Dotzler [:asa]]

can you please obsolete the checked in patch so it doesn't show up on queries
for approved and open patches? Thanks.

Comment 16

[Kai Engert (:KaiE:)]

Comment on attachment 75967 [details] [diff] [review]
Suggested temporary fix

marking as obsolete, because it has been checked in.

Comment 17

[Kai Engert (:KaiE:)]

I'm closing this one, because somebody filed a bug on the inability to edit the
trust of other's people, let's use the new bug 144435.

Fixed, because editing trust is no longer possible.

Comment 18

[Charles Rosendahl]

Verified - until functionality is correct, current specs disallow editing trust
bits on OP certs.