153905 - Unable to negotiate secure connection

Status: VERIFIED WORKSFORME

(Core Graveyard :: Security: UI, defect, P3)

Description

[Mike Laster]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-US; rv:1.1a) Gecko/20020610
BuildID:    2002061014

When I try to go this URL, I get the following error:

Error trying to validate certificate from www48.americanexpress.com using OSCP -
unauthorized request.

I can securely connect fine from OmniWeb, so I know the server isn't misconfigured.


Reproducible: Always
Steps to Reproduce:
1. Go to URL

Actual Results:  Error message: Error trying to validate certificate from
www48.americanexpress.com using OSCP - unauthorized request.


Expected Results:  It should have negotiated a secure session and returned the page.

Comment 1

[benc]

-> PSM.

Comment 2

[John Unruh]

The workaround is to turn off OCSP, which is off by default. 
Edit>Prefs>Privacy>Validation>Do not use OCSP.

Comment 3

[Greg K.]

Mike, when I access the URL, I'm redirected to
[http://www.americanexpress.com/homepage/mt_personal.shtml]. What other steps
did you take to get to that point?

Comment 4

[Mike Laster]

Strange...there are no additional steps for me.  Let's try backing up one page.

Start at: http://www.americanexpress.com/homepage/personal.shtml

And then click on the "Login in to check & pay your bill online" link.  That is the original 
URL I posted, and the one that is giving me trouble.

Comment 5

[Greg K.]

Confirmed using FizzillaCFM/2002061014, with OCSP set to "Use OSCP to validate
only certificates that specify an OCSP service URL." Reducing Severity to minor
since the workaround is as specified in Comment #2.

Comment 6

[John Unruh]

Looks like a dupe of bug 151271.

Comment 7

[Stephane Saux]

NSS landed the code to properly recognize the "unauthorized" error from the OCSP
responder. The error still prevents the user from connecting to the site, but
that's the correct behavior. We've talked to Verisign about this and they agreed
that they sometime improperly return an "unauthorized" response because of a
server side misconfiguration.

Reporter please try a recent branch build.

Comment 8

[Mike Laster]

The problem is still there on build 2002062408.  I can work around this problem
by disabling OCSP entirely.  This workaround is good enough for my use.  I just
wanted to report the problem so that it is brought to someone's attention.  If
it's actually a server misconfiguration, maybe it would be useful for the error
message to explain the situation with enough detail that it can be forewarded to
the webmaster of the offending site in hopes of getting the problem fixed.

Comment 9

[John Unruh]

Marking works for me.

Comment 10

[John Unruh]

verified.