1444427 - Provide info regarding symantec distrust action

Status: RESOLVED WONTFIX

(Developer Documentation Graveyard :: Security, enhancement, P3)

Description

[Selena Deckelmann :selenamarie :selena]

:: Developer Documentation Request

      Request Type: Correction
     Gecko Version: unspecified
 Technical Contact: [e-mail]

:: Details

SEC_ERROR_UNKNOWN_ISSUER is going to happen for certificates that were issued through the Symantec CA. We should add an entry that explains that this might be happening and the user should let the website administrator know.

Comment 1

[J.C. Jones [:jcj] (he/they)]

MOZILLA_PKIX_ERROR_ADDITIONAL_POLICY_CONSTRAINT_FAILED will be the primary error. Some servers will still prompt SEC_ERROR_UNKNOWN_ISSUER if they are configured strangely, unfortunately.

We can point to https://wiki.mozilla.org/CA/Upcoming_Distrust_Actions from MOZILLA_PKIX_ERROR_ADDITIONAL_POLICY_CONSTRAINT_FAILED, in particular.

Comment 2

[J.C. Jones [:jcj] (he/they)]

Note: I've edited https://support.mozilla.org/en-US/kb/what-does-your-connection-is-not-secure-mean to include the new error.

Comment 3

[Boris Zbarsky [:bzbarsky]]

In Chrome, the error message mentions "ERR_CERT_SYMANTEC_LEGACY", which makes it really easy to connect the  dots.  Could we do something like that?

Comment 4

[BMO Automation]

MDN Web Docs' bug reporting has now moved to GitHub. From now on, please file content bugs at https://github.com/mdn/sprints/issues/ and platform bugs at https://github.com/mdn/kuma/issues/.