1696699 - Not possible to transform a temporary certificate exception into a permanent one (or vice versa)

Status: RESOLVED INCOMPLETE

(Core :: Security: PSM, defect)

Description

[Alain Knaff]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0

Steps to reproduce:

1. Visit a site with a self-signed certificate
2. Accept certificate (with the intention of only accepting it for this session)
3. As suggested in comment 2 of bug 1662651, go to about:preferences#privacy , ViewCertificates
4. Click "Add Exception", enter site's name whose exception status you want to change, and click "Get certificate"
5. (on dialog opened by #3) Right-Click on certificate's Lifetime column to attempt to change it from Permanent into Temporary
6. (on dialog opened by #3) Doubleclick on certificate

Actual results:

4. A dialog saying "This site provides valid, verified identification. There is no need to add an exception" without offering any possibility to change the exception's status from permanent to temporary or vice-versa.
5. No Context menu appears on right click. There is no option to change Permanent into Temporary.
6. Certificate viewer opens, with no possibility to edit any trust setting

Expected results:

4. It's ok if "Get Certificate" points out that an exception already exists, but it should give me the option to change its lifetime (a changeable "Permanently store this exception" checkbox)

5. A context menu with "Make exception permanent" / "Make exception temporary" should appear

6. Rather than opening a viewer showing just the certificate, a viewer showing the trust status of this certificate in relation to this domain, and allowing to change this trust setting.

Of course the least cumbersome interface would be to get back to the old behavior where you had the "Permanently store this exception" checkbox right in the default workflow that shows up under step 2. That way, there'd be no need to change an exception's status from permanent into temporary or vice-versa, as you could make the appropriate choice from the get-go.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::Security: PSM' component, and is moving the bug to that component. Please revert this change in case you think the bot is wrong.

Comment 2

[Dana Keeler (she/her) [:keeler]]

If you first delete the old exception in the security manager, does it work as expected?