157224 - RFE: allow override of invalid signature on SSL server certs

Status: RESOLVED INVALID

(Core Graveyard :: Security: UI, enhancement, P3)

Description

[Nelson Bolyard (seldom reads bugmail)]

This issue is with all versions of PSM in N6, N7 and Moz 1.0.

When SSL is verifying the cert chain of an SSL server cert, it may find
many problems with certs in the chain, such as a cert from an unknown
issuer, a cert from a known but untrusted issuer, or a cert with an 
invalid signature.  In the cases of unknown or untrusted issuers, PSM 
allows the user to choose to trust the cert and continue with the operation.  
In the case where the signature is invalid, PSM does not give the user this
choice.  This is inconsistent.

Comment 1

[Nelson Bolyard (seldom reads bugmail)]

We also let the user accept expired certificates.  So, the case of 
the invalid signature seems to be the exception to the general rule
that PSM ordinarily allows users to accept/trust certs.

Comment 2

[Stephane Saux]

We need a consensus within the security team. Because any change would involve
some UI, this won't happen soon.

cc thayes.

Comment 3

[Nelson Bolyard (seldom reads bugmail)]

The resolution to this bug may not require the addition of any new dialogs.
It may suffice to simply use an existing dialog in a place where it is not
now being used.

Comment 4

[John G. Myers]

The case of an invalid signature is fundamentally different than the other cases
which currently allow the user to accept/trust certs.  It is akin to the case of
a bad MAC on a SSL frame.  It is a protocol failure, not a lack of trust, so
asking the user about trust is not appropriate.

Suggest closing INVALID.

Comment 5

[Nelson Bolyard (seldom reads bugmail)]

I agree.