1446769 - SEC_ERROR_UNKNOWN_ISSUER even after importing CA certificate

Status: RESOLVED WORKSFORME

(Firefox for Android Graveyard :: General, defect)

Description

[Raphaël Halimi]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:58.0) Gecko/20100101 Firefox/58.0
Build ID: 20180219150722

Steps to reproduce:

I imported the CA certificate in Firefox (checking only the first check box, "Trusting websites" or something similar) that I use to sign the SSL certificates of the websites in my LAN.


Actual results:

Firefox still displays a security warning when visiting a website presenting a certificate signed by this CA.


Expected results:

Firefox should trust the certificate since it's signed by a CA I imported, and behave as if the certificate was issued by a trusted CA. Firefox for Desktop (Linux, on different PCs with both ESR and stable) do that and display a nice green padlock on the address bar just like any other trusted CA.

Comment 1

[Raphaël Halimi]

See also https://bugzilla.mozilla.org/show_bug.cgi?id=1076329 - I'm not sure it's a duplicate, since this one is very old and was fixed in Firefox 38, so it seems it's a regression.

Also, I'm not sure in which version of FF for Android this regression was introduced, but at least 58 and 59 suffer from it.

Comment 2

[Bogdan Surd, QA [:bsurd, NI]]

Hello, 

Could you please attach the certificate and tell me the site so that I might try to find a regression window for this? 

Thank you!

Comment 3

[Raphaël Halimi]

I can provide you the CA root certificate but the sites using it are only accessible from my LAN (or through my VPN).

Comment 4

[Bogdan Surd, QA [:bsurd, NI]]

We could do that or you could help us find the regression if you would like to. You would have to install mozregression and set up ADB tho.

For mozregression: https://mozilla.github.io/mozregression/install.html
For ADB you will need to download the platform tools and set the windows system variable for them https://developer.android.com/studio/releases/platform-tools.html
If you're on linux(debian) sudo apt-get install adb should install and make adb available, for fedora sudo yum install android-tools.


After setting everything up you can run a bisection in the cmd/terminal window by simply using the command mozregression --app fennec --good 201x-xx-xx --bad 2018-xx-xx and mozregression will automatically download and install build on your device. 

For the good or bad dates you just enter a date when you think this was not an issue for FF and the bad date you set it to when you first encountered the problem. You can also go by FF versions (eg. --good 56 --bad 59).

Please let us know how you would like to proceed and thank you for your help!

Comment 5

[Raphaël Halimi]

I often use ADB, so trying mozregression shouldn't be a problem. I didn't know that this tool existed, it seems neat. I'll try it and report my findings.

Comment 6

[Raphaël Halimi]

Hi,

Sorry, I couldn't find any useful information.

I started with:

mozregression --app fennec --good 2017-12-01 --bad 2018-02-27

2018-02-27 being the date I first encountered the problem (I'm positive on this), and 2017-12-01 a date when I guess this was working. mozregression then downloaded a version (59.0a1) on which it worked (I could install the CA and when I visited the website, no SEC_ERROR, and nice green padlock), and then another one (60.0a1) on which it worked too, but then mozregression  exited with :

ERROR: Build was expected to be bad! The initial good/bad range seems incorrect.

I suppose this is because mozregression uses nightly, whereas on my device I use stable (so I can't expect the dates I remember to match nightly, obviously).

So I also tried:

mozregression --app fennec --good 57 --bad 58

But it didn't work either, because with the first version installed by mozregression (57.0a1), when I try to import the certificate, nothing happens, no dialog asking me if the certificate should be used with websites or e-mail or whatever. So I can't tell mozregression if the release is good or bad. I tried to skip, but mozregression refuses to do that ("INFO: You can not skip this build.")

I then tried :

mozregression --app fennec --good 58 --bad 59

(knowing those versions are wrong, since both as I recall, 58 and 59 are affected) but mozregression exits with:

The url [...] contains no pushlog. Maybe use another range ?

I then tried:

mozregression --app fennec --good 56 --bad 58

but again, with 59.0a1 I can't download the certificate, so I can't tell mozregression if this release is good or bad.

I'm at a loss here. What else could I try to help you ?

Comment 7

[Bogdan Surd, QA [:bsurd, NI]]

Thank you for all the help so far. 

> ERROR: Build was expected to be bad! The initial good/bad range seems
> incorrect.

If you have encountered this error mozregression downloaded the build that you said is supposed to be bad but when you tested the issue on the respective build you gave it a good rating. You could try using a wider range for eg. --good 2017-12-01 --bad 2018-03-20 for eg.

If you do a clear data for the stable (Release) build that you have installed on your device is the issue still reproducible?

Comment 8

[Raphaël Halimi]

I hoped to avoid this because re-setting everything is quite tedious, but I did delete the app's data and the problem is gone. Maybe it was fixed in one of the last two releases (2018-02-27 is when I encountered the problem, and also when I first imported the CA certificate - I'm pretty sure it was 58, but I'm not positive - and I remember there were two updates after that), but my profile must have been damaged somehow by the culprit release.

I guess the bug can be closed, but I'm not sure which release fixed it (I'd guess 59 but again I'm not sure).

In any case, thanks a lot for your help.

Comment 9

[Raphaël Halimi]

If it can help you identify the culprit release, I remember that on 2018-02-27, when I imported the certificate, the dialog proposed three check boxes (websites, e-mails, and software developers) whereas now it proposes only two (websites and e-mails).

Comment 10

[Bogdan Surd, QA [:bsurd, NI]]

Glad the issue is fixed for you, seeing as the issue is no longer valid, I will be closing the bug. If you do however encounter the issue again in future releases please feel free to open up a new bug and thanks for all your help in investigating this!