1613443 - built-in distrusted certificates should not be shown in the "servers" tab of the certificate manager

Status: RESOLVED DUPLICATE of bug 1645492

(Core :: Security: PSM, enhancement, P3)

Description

[mozsecurity]

Attachment: diginotar_server.jpg

User Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0

Steps to reproduce:

Opened the certificate manager (on a Firefox version which had been updated many times).

Actual results:

There are Diginotar certificates and I can't verify that they are not trusted.

Expected results:

Some verification message proofing that these certificates are in fact untrusted and only there to prevent them to be imported and trusted.

Comment 1

[mozsecurity]

Attachment: diginotar_nottrusted_where.jpg

Comment 2

[Wayne Thayer]

Dana: can you help explain the issue here?

Comment 3

[Mathew Hodson]

This looks like the same issue as bug 829677, or at least solving that bug would also solve the issue here.

Comment 4

[mozsecurity]

I would say it is not necessary to remove them (as they serve the purpose of blocking "fraudulent" certificates), but it would be helpful to show the user that these aren't trusted (i.e. have their title being written in red and show red "here for preventing the certificate to be trusted , don't remove" under the title on the details).

Currently one could think that someone wants to spy on the user as they seem to be trusted for all servers in the UI. Maybe the text in the server column should be changed from showing * to "none (certificate revoked)" or something like this.

Comment 5

[Mathew Hodson]

There is also bug 733716 which is about improving the UI of the certificate manager.

Comment 6

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Those are left over from the DigiNotar incident. My understanding is NSS used to store a copy of the certificate along with the distrust record (when in theory all that's needed is the distrust record). We shouldn't even be showing those kinds of certificates in that tab.

Comment 7

[mozsecurity]

If I understand the comments on the other bugs correctly the shown certificates aren't real DigiNotar certificates, but dummy certificates (invalid signature and higher serial number) as a quirk to prevent the real ones to be imported by incident.

In my opinion the UI should be improved to show whether the certificates are being trusted or not. The current certificate detail UI is hiding some details from other certificates too (i.e. DNS naming constraints). I think the former UI showed more details of a certificate (but maybe I remember the Windows certificate UI).