1491498 - Include revocation errors in the clock skew errors list

Status: NEW

(Firefox :: Security, defect, P3)

Description

[Damira Akh]

Attachment: EXPECTED_RESULT.png

Steps to Reproduce:
1. Change Date and Time of the OS.
2. Launch Nightly
3. Go to any website 

I added expected and actual result screenshots.

Comment 1

[Damira Akh]

Attachment: ACTUAL_RESULT.png

Comment 2

[Johann Hofmann [:johannh]]

Hm, I can't reproduce this but I can believe that a wrong system time might cause troubles with OCSP.

To what did you change your OS time and date? Note that only setting backwards in time makes the new error page 100% reliable, since we have a few technical limitations in detecting if the system clock is too far in the future.

Dana, do you think we'll have to add this error code to the list of sites that get the "wrong system clock" treatment?

Comment 3

[Damira Akh]

@[e-mail] 
I changed the date from 9/14/2018 to 9/11/2017. Time is the same.

Comment 4

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

I don't think that's directly due to an incorrect clock - from my reading of the code, we only return that error when the response was signed by a delegated certificate but the response doesn't contain a certificate that matches the responder ID in the response (see https://searchfox.org/mozilla-central/rev/6c82481caa506a240a626bb44a2b8cbe0eedb3a0/security/pkix/lib/pkixocsp.cpp#243 ).

Comment 5

[Johann Hofmann [:johannh]]

Damira, what happens if you set your clock back much further than 2017? e.g. 1990?

Comment 6

[Damira Akh]

I changed to 1990 and got the following error code. I attached screenshot

Comment 7

[Damira Akh]

Attachment: 1990.png

Comment 8

[Johann Hofmann [:johannh]]

Yeah, so I'd recommend you to always set the clock back a little further than just a year. To be clear, our project is not about detecting 100% of all system clock skew errors, but rather showing a good error pages in those cases where we are 100% certain that it's because of system clock skew.

Not sure if we can close this or whether we still want to consider giving SEC_ERROR_OCSP_INVALID_SIGNING_CERT a special treatment if the system clock is off.