1661334 - Nightly sees some TLS cert as 'revoked'; works in other browsers; rated A+ by ssllabs.com

Status: RESOLVED INCOMPLETE

(Core :: Security: PSM, defect)

Description

[sebboh (use needinfo)]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0

Steps to reproduce:

Visit https://securemail-uchealth.org/s/e?

Actual results:

Secure Connection Failed

An error occurred during a connection to securemail-uchealth.org. Peer’s Certificate has been revoked.

Error code: SEC_ERROR_REVOKED_CERTIFICATE

The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
Please contact the website owners to inform them of this problem.

Learn more… [link] Try Again [button]

Expected results:

Connection established.

Because.. the TLS stuff on that site is fine, right? This TLS evaluation tool gives it an "A+" rating. https://www.ssllabs.com/ssltest/analyze.html?d=securemail-uchealth.org

Comment 1

[BugBot [:suhaib / :marco]]

The severity field is not set for this bug.
:jcj, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 2

[J.C. Jones [:jcj] (he/they)]

Hi Dave,

Sorry for the lateness in my reply, I honestly didn't realize I was triaging this component now.

I can't reproduce now, sadly. Server looks fine. Since Firefox is the only browser that checks OCSP for all certificates, the most likely answer was a spurious error from the issuing CA's OCSP responder. That would be a problem we could take to them, if we caught it, but I've no evidence at present.

Let me know if this happens again! Feel free to needinfo me - sorry again for my tardiness.

Cheers,
J.C.

Comment 3

[sebboh (use needinfo)]

I just tried it today and got the same error.

What happens if my browser can't reach one of these OCSP responders? My machine lives on a corporate network and seemingly random machines get blocked. Is there some kind of console or log I can view to see a status message for each of the steps Nightly takes during TLS setup? I guess checking OCSP is one of the steps (or a group of them).

Cheers,
--sebboh ("dave")

Comment 4

[BugBot [:suhaib / :marco]]

The severity field is not set for this bug.
:jcj, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 5

[J.C. Jones [:jcj] (he/they)]

We have a log name certverifier that would narrow this down.

If you open about:networking, go to logging in the left menu, then set the "Log Modules" text box to certverifier:5 and hit "Set Log Modules", then the log should have the details we'd need.

To get it clean, open a tab with https://securemail-uchealth.org/ and let the error show up. Go to the about:networking tab and click "Start Logging", go back to the UCHealth tab, force a refresh (Hold both the Ctrl and ⇧ Shift keys and then press R.), then go back to about:networkign and "Stop Logging". Find the file, and attach it or copy/paste it here, and we'll take a look! feel free to needinfo me - sorry I missed the post from 5 days ago.

Comment 6

[sebboh (use needinfo)]

Attachment: certverifier:5 log

Wow! This is my new favorite thing!  Thank you, jcj!

```

Comment 7

[sebboh (use needinfo)]

Comment on attachment 9175916 [details]
certverifier:5 log

Two log files were generated, "main" (this one) and "child" (which was 0 bytes).

Comment 8

[sebboh (use needinfo)]

Pardon me, I seem to have posted an incomplete message.. Comment #6, #7, and this one all go together.

I meant to say that about:networking is my new favorite thing, even though I didn't learn too much from this particular log..

I'll needinfo you, jcj. So, you work on "Security: PSM" too? Thanks again. I think about:networking will be useful to me in more than one context.

Comment 9

[Dana Keeler (she/her) [:keeler]]

Can you attach a packet trace of a TLS handshake with the server that doesn't work? (using e.g. wireshark)

Comment 10

[J.C. Jones [:jcj] (he/they)]

Glad you like it, dave! I think it's the superior way to get at that log data, too. Was glad when it landed around the time of Quantum.

As Dana said, your log shows that OCSP was good, coming in a stapled response from the server, so I'm afraid we're going to need a packet capture. I don't think we'll need the SSLKEYLOGFILE for this, it should be apparent in the plaintext part of the connection what's going wrong.
Thanks!

Comment 11

[sebboh (use needinfo)]

Attachment: firefox-packet-capture-20201030.pcap

Here is a packet capture.

Comment 12

[Dana Keeler (she/her) [:keeler]]

Thanks. Can you attach any files in the security_state folder in your profile directory?

Comment 13

[sebboh (use needinfo)]

I have five files in there.

10/30/2020  03:19 PM         5,770,363 crlite.filter
10/30/2020  03:19 PM           761,733 crlite.stash
11/15/2019  11:01 AM        16,777,216 data.mdb
10/30/2020  03:19 PM         4,618,044 data.safe.bin
03/25/2019  09:03 AM             8,192 lock.mdb

Are these files safe to share? This is on my work computer.

I have new information. I tried creating a new, empty profile, and guess what.. In the fresh Firefox profile, I can access securemail-uchealth.org!

One thing special about my normal profile is that I have distrusted a lot of CAs.

Reminder, the error I get is "SEC_ERROR_REVOKED_CERTIFICATE".

Anyway, if the files from security_state are safe to share, then I'll do that. Please advise.

Comment 14

[Dana Keeler (she/her) [:keeler]]

Those files are all downloaded from mozilla, so there's nothing private there.

One thing special about my normal profile is that I have distrusted a lot of CAs.

Does it work if you re-trust those CAs?