126653 - NSS3.4 USPS cert in Web Site certs by default

Status: VERIFIED FIXED

(Core Graveyard :: Security: UI, defect, P1)

Description

[John Unruh]

1.) Create a new profile and start the browser.
2.) Open the Cert Manager and Web Sites tab.
What happens: The US Post Office cert appears.
What is expected: No cert should be there in a new profile. 2/20 Win2000 trunk.

Comment 1

[Stephane Saux]

cc relyea and wtc.  Since this behavior wasn't present pre NSS3.4 is suspect
that 3.4 has something to do with it.

Comment 2

[Stephane Saux]

This is still occurring in Build ID 2002022503

Comment 3

[Robert Relyea]

Ian, is this cert new?

bob

Comment 4

[Ian McGreer]

I presume the cert is "USPS Production 1".  This cert is not at all new.  It is
an intermediate CA cert issued by "USPS Root".  It should not be default
trusted, as it is not a root.  What it should be marked as is "valid CA", so
that it shows up as untrusted in the CA list (previously, it was marked as
untrusted, so it didn't show up; the customer did not like that).  However, it
is marked as "valid peer", causing it to show up in the web sites tab.  I don't
know why this showed up in 3.4, but the builtin entry is marked incorrectly at
any rate.

Comment 5

[Ian McGreer]

Attachment: trust USPS Production 1 as valid CA

Comment 6

[Ian McGreer]

patched checked in.  Will have to wait for next PSM update.

Comment 7

[Nelson Bolyard (seldom reads bugmail)]

Ian, Doesn't the trust flag "valid CA" imply that it's trusted?
I agree with your comment that intermediate CAs should not be marked
as trusted.  Does the change you made cause this CA to be trusted now?

Comment 8

[Ian McGreer]

No.  "valid" is equivalent to "c,c,c", "Trusted" is equivalent to "C,C,C".

Comment 9

[Robert Relyea]

No Trusted CA means it's trusted, Valid CA means simply that it is a CA.

Comment 10

[Wan-Teh Chang]

Comment on attachment 71911 [details] [diff] [review]
trust USPS Production 1 as valid CA

I checked Ian's patch into the NSS_CLIENT_TAG of NSS.
I think this bug can be marked fixed now.

Comment 11

[Kai Engert (:KaiE:)]

Marking fixed as wtc suggested.

Comment 12

[John Unruh]

Verified that the USPS Production 1 CA appears now in the authorities tab and 
not the web sites tab. The CA is also NOT trusted. Please open a new bug if that 
is not correct.

Comment 13

[Wan-Teh Chang]

It is correct that the USPS Production 1 CA is NOT trusted.