143744 - Browser doesn't load page with SSL pages with misconfigured/questionable certificates.

Status: VERIFIED INVALID

(Core Graveyard :: Security: UI, defect)

Description

[Becker-Freyseng, Christoph]

Mozilla 1.0 RC1, 0.98 and 0.99, too.


Once I accept the certificate of https://www.camgaroo.com/ I can't load
https://www.mmc-startup.com/ .
At first Mozilla tells me that this certificate (the Browser gets from
mmc-startup.com) is wrong and is issued for www.camgaroo.com. Then I say accept
(anyway). It asks once again... Finally I get this error-message:
"www.mmc-startup.com has received an incorrect or unexpected message. Error Code:
-12227". And the page won't load.

After I delete the stored certificate I can open https://www.mmc-startup.com/
but now the problem is just the other way round.

There is no such problem with IE 6.0.

We made these certificates on our own, so they are from the same CA. Probably
the problem is caused because both certificates have the same Serial Number (and
perhaps because they are also from the same CA). Maybe Mozilla distinguisches
certificates by Serial Number (and maybe CA) and when it gets another cert with
the same Serial Number it comes into trouble.

Comment 1

[Becker-Freyseng, Christoph]

Attachment: Screenshots that lead to this bug

Comment 2

[Becker-Freyseng, Christoph]

I just found out that this problem only occurs when I say "Remember this
certificate permanently" on the first page.

Additionally I added some screenshots (see attachments).

Comment 3

[John Unruh]

Confirming.

Comment 4

[Kai Engert (:KaiE:)]

Without knowing more details, I'd suspect it is a problem at the SSL or cert
database layer.

Comment 5

[Kai Engert (:KaiE:)]

Marking invalid.

I agree the problem you saw was most likely caused by both certs having the same
issuer and same serial number. You seem to have installed new certificates on
the sites.

Comment 6

[John Unruh]

V

Comment 7

[Becker-Freyseng, Christoph]

Yes I made new Certs as there was probably a trojan on the server.

Is it OK for Mozilla not to load a page when issuer and serial number are the same? 

Comment 8

[Kai Engert (:KaiE:)]

Yes, your configuration was invalid. There is another bug which has more info
and which was resolved recently...

In that other bug it was said, a unique combination of {issuer, serial number}
is a MUST requirement defined in RFCs for PKI.

Comment 9

[Kai Engert (:KaiE:)]

Found it, see bug 144889.