1535633 - Valid certificate with incomplete chain shows insecure warning

Status: RESOLVED DUPLICATE of bug 1535662

(Core :: Security: PSM, defect)

Description

[13hu]

Attachment: Chrome shows cert as valid

Firefox 65.0.1 mac

To reproduce:

• https://www.ccssforum.org/

www.ccssforum.org uses an invalid security certificate. 
The certificate is not trusted because the issuer certificate is unknown. 
The server might not be sending the appropriate intermediate certificates. 
An additional root certificate may need to be imported. 

Error code: SEC_ERROR_UNKNOWN_ISSUER

In Chrome, the site can be visited without any warnings

SSL Labs gives the site a grade of B
Chain issues Incomplete

should this case be treated as secure ?

Comment 1

[Matthias Versen [:Matti]]

A connection can of course not treated as secure if the chain is incomplete.
The only option is that Firefox tries to download the intermediate certificates on it's own to complete the chain to fix the broken website.

Chrome shows the certificate only as valid because either the intermediate certificate is cached or windows downloaded the intermediate on it's own in the windows certificate store.

Comment 2

[13hu]

(In reply to Matthias Versen [:Matti] from comment #1)

Chrome shows the certificate only as valid because either the intermediate certificate is cached or windows downloaded the intermediate on it's own in the windows certificate store.

This is on mac, FYI

Comment 3

[Dana Keeler (she/her) (use needinfo) [:keeler]]

This will be addressed by intermediate preloading.