1453357 - Thunderbird certificate viewer reports "issuer is unknown" for valid e-mail CA

Status: REOPENED

(Thunderbird :: Security, defect)

Description

[Jakob Bohm]

User Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:3.4) Gecko/20100101 Goanna/20180327 PaleMoon/27.8.3
Build ID: 20180327191532

Steps to reproduce:

1. In PSM (Options, Advanced, Certificates, Manage Certificates) go to the Authorities tab.
2. Select any CA trusted for e-mail user certifictes (S/MIME certificates).
3. Edit Trust and specify that the CA is trusted only for e-mail, not websites (SSL) by unchecking the "websites" checkbox.
4. Click View.
5. The Certificate Viewer General tab falsely reports "Could not verify this certificate because the issuer is unknown"

The same happens for e-mail only SubCa certificates whose Extended Key Usage specifies that it is only for e-mail protection etc., not TLS.



Actual results:

The top of the PSM Certificate Viewer General Tab shows "Could not verify this certificate because the issuer is unknown"


Expected results:

The message should have been "This certificate has been verified for the following uses: [S/MIME Certificate Authority]"

Also, CAs valid for both S/MIME and TLS should report both on the general tab.

I suspect the current PSM Certificate Viewer is simply not checking if a certificate is a valid S/MIME CA and/or valid TLS Client CA.

Comment 1

[Dana Keeler (she/her) [:keeler]]

This was essentially removed by bug 1257403. Firefox doesn't use S/MIME certificates for anything, so there's no need to support them. In the future we might even remove the UI for the email trust bit.

Comment 2

[Jakob Bohm]

This bug was reported against Thunderbird, NOT Firefox and applies to the PSM included in Thunderbird. The incorrect error message has since changed to "Could not verify this certificate for unknown reasons". See also related bug comment
https://bugzilla.mozilla.org/show_bug.cgi?id=1257403#c12

If the core team will not fix this in the shared code, then the Thunderbird team would have to maintain its own fork of the PSM that doesn't break e-mail.

Bug is still present in Thunderbird 68.2.0 (current shipping).

Note that Thunderbird uses both "SSL/TLS" certificates (for server connections) and S/MIME certificates (for signing and encrypting e-mails).

Similarly, Firefox itself still seems to support "SSL/TLS" client certificates for authentication against web servers that offer this facility, in practice, most but not all client certificates are also e-mail certificates.

Comment 3

[Jorg K (CEST = GMT+2)]

Kai, do we need to action this for TB?

Comment 4

[Kai Engert [:KaiE:]]

Ok, let's reopen this as a Thunderbird bug.

Yeah, this UI is shared with Firefox. If Firefox removes parts that we need for Thunderbird, then we must either fork that code, or find a way for conditional compilation that is acceptable to the Firefox developers.