Open Bug 1468325 Opened 8 years ago Updated 3 years ago

TLS handshake fails only after importing CA

Categories

(Thunderbird :: Security, defect)

Product:
Thunderbird
Component:
Security
Version:
52 Branch
Type:
defect

Tracking

(Not tracked)

Status:
UNCONFIRMED

People

(Reporter: debian, Unassigned)

Details

User Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.98 Safari/537.36 Steps to reproduce: 1. I set up TB as imap client for a remote dovecot server. The server accepts imaps and imap with STARTTLS. The CA is my own, i.e. is not in the standard CAs included with TB. 2. I created an account using this server and it worked nice with both imaps and imap with STARTTLS. TB is asking me to confirm the unknown CA by a security exception request. 3. I imported the CA certificate to TB's CA store. Actual results: TB cannot connect anymore - neither imaps nor imap with STARTTLS. It does not show the security exception, but it states that the server does not support the authentication method. Dovecot has the following log entry for these attempts: TLS handshaking: SSL_accept() failed: error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate: SSL alert number 42 (After removing the CA from TB it works as it did before.) Expected results: TB should have connected like it did before, but without showing the security exception request.
Following the latest Debian update on Thunderbird, it now also denies STARTTLS with SMTP. It used to work before the update. Error is the same. I have meanwhile found similar reports. Some ask whether the certificate chain works with Firefox. It does! All of my https intranet sites root in that same certificate. https://bugzilla.mozilla.org/show_bug.cgi?id=1452154 seems to be something similar, and Google showed a bug from 2014 (which unfortunately I cannot find anymore), which used the same work-around with no solution. So I guess it's something weired in the code for many years.
Ah, there is the issue from 2014 bach with TB 31.0: https://bugzilla.mozilla.org/show_bug.cgi?id=1452154
Sorry wrong clipboard: https://support.mozilla.org/de/questions/1011915 This is 2014 TB 31.
Severity: normal → S3
You need to log in before you can comment on or make changes to this bug.