1774374 - Certificate error on fennec for fdroid for https://openup.uni-potsdam.de/ certified by GEANT OV RSA CA 4

Status: RESOLVED DUPLICATE of bug 1520297

(Core :: Security: PSM, defect)

Description

[Manuel Bucher [:manuel]]

Attachment: Screenshot_20220615-113753_Fennec.png

I'm getting a certificate error on https://openup.uni-potsdam.de/ on fennec for f-droid (probably also applies for firefox on android?). It correctly loads on the default Browser-App on the same device. Firefox on Linux + Chromium on Linux also load that page fine without any certificate errors.

OS is LineageOS 19.1 (based on Android 12).

I'm not sure if that bug also applies to normal android + firefox from the play store, but might be worth investigating.

Feel free to move it to the correct component if this isn't the correct one.

CERT: GEANT OV RSA CA 4

Fennec version:
101.1.1 (Build #1011120), 8092b4e74+
AC: 101.0.10, db7e8a692a
GV: 101.0-20220602102315
AS: 91.1.2

Not sure which NSS version, therefore selected "other".

Comment 1

[Ben Wilson]

I get the same behavior on my Android device, but I'm thinking that this isn't a problem on our end, but a website configuration issue. In any event, the Component "Common CA Database" would not be the right place to file this issue.

Comment 2

[Dennis Jackson]

The site works correctly for me on Firefox on Android Nightly, but not on Release. The error indicates that the issuer is unknown - likely that the site is not sending the correct intermediate certs?

Comment 3

[Ben Wilson]

The server seems to be sending the wrong chain of certificates (DFN-Verein Global Issuing CA vs. GEANT OV RSA CA 4).

Comment 4

[Ben Wilson]

I advised the University of Potsdam of this issue - Trouble Ticket # 2022061510002435.