built-in distrusted certificates should not be shown in the "servers" tab of the certificate manager
Categories
(Core :: Security: PSM, enhancement, P3)
Tracking
()
People
(Reporter: mozsecurity, Unassigned)
Details
(Whiteboard: [psm-backlog])
Attachments
(2 files)
User Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0
Steps to reproduce:
Opened the certificate manager (on a Firefox version which had been updated many times).
Actual results:
There are Diginotar certificates and I can't verify that they are not trusted.
Expected results:
Some verification message proofing that these certificates are in fact untrusted and only there to prevent them to be imported and trusted.
Reporter | ||
Comment 1•5 years ago
|
||
Comment 3•5 years ago
|
||
This looks like the same issue as bug 829677, or at least solving that bug would also solve the issue here.
Reporter | ||
Comment 4•5 years ago
|
||
I would say it is not necessary to remove them (as they serve the purpose of blocking "fraudulent" certificates), but it would be helpful to show the user that these aren't trusted (i.e. have their title being written in red and show red "here for preventing the certificate to be trusted , don't remove" under the title on the details).
Currently one could think that someone wants to spy on the user as they seem to be trusted for all servers in the UI. Maybe the text in the server column should be changed from showing * to "none (certificate revoked)" or something like this.
Comment 5•5 years ago
|
||
There is also bug 733716 which is about improving the UI of the certificate manager.
![]() |
||
Comment 6•5 years ago
|
||
Those are left over from the DigiNotar incident. My understanding is NSS used to store a copy of the certificate along with the distrust record (when in theory all that's needed is the distrust record). We shouldn't even be showing those kinds of certificates in that tab.
Reporter | ||
Comment 7•5 years ago
|
||
If I understand the comments on the other bugs correctly the shown certificates aren't real DigiNotar certificates, but dummy certificates (invalid signature and higher serial number) as a quirk to prevent the real ones to be imported by incident.
In my opinion the UI should be improved to show whether the certificates are being trusted or not. The current certificate detail UI is hiding some details from other certificates too (i.e. DNS naming constraints). I think the former UI showed more details of a certificate (but maybe I remember the Windows certificate UI).
![]() |
||
Updated•5 years ago
|
![]() |
||
Updated•4 years ago
|
Description
•