Closed Bug 1792405 Opened 2 years ago Closed 2 years ago

Logging in to security device smartcard disables certificate recognition

Categories

(Core :: Security: PSM, defect)

Firefox 102
defect

Tracking

()

VERIFIED INVALID

People

(Reporter: vesely, Unassigned)

Details

(Keywords: regression)

Attachments

(2 files)

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0

Steps to reproduce:

Either Log In to the smartcard, or wait until asked.

Actual results:

Cannot connect to any site using HSTS, nor using explicit https: urls. The screen says: "Did Not Connect: Potential Security Issue". When hitting Advanced adds: "Error code: SEC_ERROR_UNKNOWN_ISSUER".

After hitting "Log Out" in the Device Manager, operations resume cleanly. Except I cannot acces the site which was asking for authentication with the smart card.

Expected results:

This happened after upgrading to 102.3.0esr (64-bit).

The Bugbug bot thinks this bug should belong to the 'Core::Security: PSM' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Component: Untriaged → Security: PSM
Product: Firefox → Core

When you log in to the token, do the root certificates of the sites you're trying to visit appear in the certificate manager? (about:preferences -> View Certificates - > Authorities)

Flags: needinfo?(vesely)

Yes, I see the certificates. In particular, I tried to load Google's page and Advanced/View Certificate led me to GTS Root R1, which is listed as Builtin Object Token.

Note: I have the source of the shared object. I can compile a test version if you drive me.

Flags: needinfo?(vesely)

In the certificate manager, if you select one of the affected roots and click Edit Trust is the websites box checked? (again, when logged in)

Flags: needinfo?(vesely)

Also, it would be helpful if you used https://mozilla.github.io/mozregression/ to track down when this changed.

When I Edit Trust, both checkboxes are checked.

I tried mozregression 5.0.0, but couldn't run the security device with it. As soon as I load the shared object, firefox crashes and the tool says WARNING: Process exited with code 11. I tried --good 2022-01-10 and --good 2021-05-31, same behavior. If I set a profile, firefox crashes immediately after setting up its window, without writing anything in it. The --debug option doesn't show anything more.

Flags: needinfo?(vesely)

(In reply to Alessandro Vesely from comment #3)

Note: I have the source of the shared object. I can compile a test version if you drive me.

As in, you have the source code of the module you're loading? Would you be able to share that here?

Flags: needinfo?(vesely)

I obtained that source from a fork on Github. I've been very lazy on it, using only the pkcs11 part. Right now I checked it compiles like so:

touch NEWS README ChangeLog
autoreconf -i
./configure
make
ls cie-pkcs11/.libs/libcie-pkcs11.so

However, it needs an identity card to run. Should work with any EU card, I just tested it with mine. More info on the gov site.

Flags: needinfo?(vesely)

It looks like you're using C++ exceptions? My understanding is those will get turned into aborts when used with Firefox, which may explain the crashes.

In any case, this doesn't seem like a bug in Firefox. My guess is your module is returning an error or is misbehaving in some way and NSS is deciding to not continue looking for certificates when Firefox asks for potential issuers in path building in certificate verification.

What I would suggest to you is to write a small program using the NSS APIs to replicate some of what Firefox does (e.g. load the builtin roots module, load your module, search for issuer certificates). That way, you can debug your module without Firefox getting in the way.

It may certainly be the case that NSS is doing the wrong thing, but until then, I'm going to close this bug, as there's not much we can do to help you. Feel free to re-open it if and when you find something specifically wrong with NSS.

Status: UNCONFIRMED → RESOLVED
Closed: 2 years ago
Resolution: --- → INVALID

An utility to check PKCS11 functions was already present in the software. It still works.

I looked at core dumps of nightly builds and determined that the library couldn't be loaded because the C++ function std::regex_search() was getting SIGSEGV. Presumably there's a dynamic linking mismatch, since the library loads smoothly in the regular built. Anyway, that function is inessential and I commented it out. At that point I could run mozregression. Here's the last stanza of its result:

16:59.18 INFO: Running autoland build built on 2022-03-11 00:34:26.642000, revision d3f40b46
17:09.67 INFO: Launching /tmp/user/1000/tmpefufo0vs/firefox/firefox
17:09.67 INFO: Application command: /tmp/user/1000/tmpefufo0vs/firefox/firefox --allow-downgrade -profile /tmp/user/1000/tmp8uuynz5g
17:09.68 INFO: application_buildid: 20220311001236
17:09.68 INFO: application_changeset: d3f40b4651f51269e707f9f06c2053e2c9d0fe11
17:09.68 INFO: application_name: Firefox
17:09.68 INFO: application_repository: https://hg.mozilla.org/integration/autoland
17:09.68 INFO: application_version: 100.0a1
Was this integration build good, bad, or broken? (type 'good', 'bad', 'skip', 'retry', 'back' or 'exit' and press Enter): 17:11.95 INFO: b'File INI:/etc/ciepki.ini'
good
18:02.38 INFO: Narrowed integration regression window from [8d51f978, f0bcbabe] (4 builds) to [d3f40b46, f0bcbabe] (2 builds) (~1 steps left)
18:02.38 INFO: No more integration revisions, bisection finished.
18:02.38 INFO: Last good revision: d3f40b4651f51269e707f9f06c2053e2c9d0fe11
18:02.38 INFO: First bad revision: f0bcbabee6dbf3d227307af0c1f26a92316cba4e
18:02.38 INFO: Pushlog:
https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=d3f40b4651f51269e707f9f06c2053e2c9d0fe11&tochange=f0bcbabee6dbf3d227307af0c1f26a92316cba4e

Bug 1756061 - PSM changes corresponding to mozilla::pkix signature verification changes in bug 1755092 r=jschanck

Bug 1755092 changed how mozilla::pkix verifies signatures. This patch makes the
corresponding changes in PSM.

Depends on D140597

Differential Revision: https://phabricator.services.mozilla.com/D139202
Status: RESOLVED → VERIFIED

Based on comment #10, this bug contains a bisection range found by mozregression. However, the Regressed by field is still not filled.

:jschanck and :keeler, since you are the authors of the changes in the range, if possible, could you fill the Regressed by field and investigate this regression?

For more information, please visit auto_nag documentation.

Flags: needinfo?(jschanck)
Flags: needinfo?(dkeeler)
Keywords: regression

For the crash caused by std::regex_search() see bug 1701658.

(In reply to Alessandro Vesely from comment #10)

https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=d3f40b4651f51269e707f9f06c2053e2c9d0fe11&tochange=f0bcbabee6dbf3d227307af0c1f26a92316cba4e

These changes allow mozilla::pkix to verify RSA-PSS signatures, and doesn't directly impact finding issuer certificates for path building.
Can you run Firefox with the environment variable MOZ_LOG set to certverifier:5,pipnss:4, log in to the token, try to connect to a site, and attach the output here?
Another thing you could do is use a debugger to step through NSSCertDBTrustDomain::FindIssuer to see if any issuers are being found.

Flags: needinfo?(vesely)
Flags: needinfo?(jschanck)
Flags: needinfo?(dkeeler)
The log is quite verbose.  This is running 102.3.0esr (64-bit).

```
Flags: needinfo?(vesely)

Thanks! What certificates are you encountering that are signed with SHA-1? Also, it looks like NSSCertDBTrustDomain::IsChainValid is failing - you might step through that with a debugger and see where it's failing.

Flags: needinfo?(vesely)

I used google.com to test https. Surprisingly, while the signatures on its certificate, its issuer's and its issuer's issuer's one are all SHA-256, the self-signed GlobalSign Root CA certificate has SHA-1.

I attach a second log. After logging in to the device, I tried to navigate to the gov site that would accept authentications by that device. It has no SHA-1 CAs in its chain. Firefox outputs nothing, no warning, no error. I tried twice, the second time on a blank tab. Nothing at all.

I tried to run firefox under gdb, but couldn't break at any function. I sourced a symbols.py which downloaded a bunch of stuff, to no avail. Isn't any debug build downloadable from somewhere?

Flags: needinfo?(vesely)

Nightly should have debug symbols: https://www.mozilla.org/en-US/firefox/channel/desktop/
Now that I think about it, the SHA-1 issue is probably due to the built-in roots having their trust bits cleared - it would be good to figure out what's doing that.

Flags: needinfo?(vesely)

Hm... been there, downloaded firefox-106.0b9.tar.bz2, unzipped, launched... no symbols.

ale@pcale:/home/moz$ gdb -q --args firefox/firefox  -profile /home/moz/moz-profile/3n4b1v8w.default -no-remote
Reading symbols from firefox/firefox...
(No debugging symbols found in firefox/firefox)
(gdb) q
Flags: needinfo?(vesely)

Same:

ale@pcale:/home/moz$ rm -rf firefox
ale@pcale:/home/moz$ tar -xjf ~/Downloads/firefox-107.0a1.en-US.linux-x86_64.tar.bz2 
ale@pcale:/home/moz$ gdb -q --args firefox/firefox  -profile /home/moz/moz-profile/3n4b1v8w.default -no-remote
Reading symbols from firefox/firefox...
(No debugging symbols found in firefox/firefox)
(gdb) q
Flags: needinfo?(vesely)

Using nm, that build does appear to have symbols:

% file firefox
firefox: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=dbd0a1f121dbb216b09d1ba22f5e0b6db1631558, for GNU/Linux 2.6.32, not stripped

% nm -U libxul.so | grep NSSCertDBTrustDomain
000000000a0b1f68 b _ZGVZN7mozilla3psm20NSSCertDBTrustDomain31NetscapeStepUpMatchesServerAuthENS_4pkix4TimeERbE14AUGUST_23_2015
000000000a0b1f78 b _ZGVZN7mozilla3psm20NSSCertDBTrustDomain31NetscapeStepUpMatchesServerAuthENS_4pkix4TimeERbE14AUGUST_23_2016
0000000003ce4cc0 t _ZN7mozilla3psm12CertVerifier35VerifyCertificateTransparencyPolicyERNS0_20NSSCertDBTrustDomainERK8nsTArrayIS4_IhEENS_4pkix5InputENS9_4TimeEPNS0_27CertificateTransparencyInfoE
0000000003ce7020 t _ZN7mozilla3psm20NSSCertDBTrustDomain10FindIssuerENS_4pkix5InputERNS2_11TrustDomain13IssuerCheckerENS2_4TimeE
0000000003ce7e40 t _ZN7mozilla3psm20NSSCertDBTrustDomain11CheckCRLiteERK8nsTArrayIhES5_S5_RKS2_I6RefPtrI18nsICRLiteTimestampEERb
0000000006583110 t _ZN7mozilla3psm20NSSCertDBTrustDomain12GetCertTrustENS_4pkix13EndEntityOrCAERKNS2_12CertPolicyIdENS2_5InputERNS2_10TrustLevelE
0000000006583ec0 t _ZN7mozilla3psm20NSSCertDBTrustDomain12IsChainValidERKNS_4pkix8DERArrayENS2_4TimeERKNS2_12CertPolicyIdE
0000000003ce7fb0 t _ZN7mozilla3psm20NSSCertDBTrustDomain15CheckRevocationENS_4pkix13EndEntityOrCAERKNS2_6CertIDENS2_4TimeENS2_8DurationEPKNS2_5InputESB_SB_
0000000003ce7d60 t _ZN7mozilla3psm20NSSCertDBTrustDomain16CheckCRLiteStashERK8nsTArrayIhES5_
...

Try breaking on a symbol anyway, even if gdb says it can't find it?

You're right, it breaks at functions. I run it like so:

ale@pcale:/home/moz$ gdb -q --args firefox/firefox  -profile /home/moz/moz-profile/3n4b1v8w.default -no-remote
Reading symbols from firefox/firefox...
(No debugging symbols found in firefox/firefox)
(gdb) break mozilla::psm::NSSCertDBTrustDomain::FindIssuer
Function "mozilla::psm::NSSCertDBTrustDomain::FindIssuer" not defined.
Make breakpoint pending on future shared library load? (y or [n]) y
Breakpoint 1 (mozilla::psm::NSSCertDBTrustDomain::FindIssuer) pending.
(gdb) run
Starting program: /home/moz/firefox/firefox -profile /home/moz/moz-profile/3n4b1v8w.default -no-remote
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
process 17075 is executing new program: /home/moz/firefox/firefox-bin
...
[Switching to Thread 0x7fffbaebe700 (LWP 17297)]

Thread 123 "SSL Cert #1" hit Breakpoint 1, 0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () from /home/moz/firefox/libxul.so

The function is called dozens of time from various threads, but no symbols can be shown:

Thread 161 "SSL Cert #4" hit Breakpoint 1, 0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () from /home/moz/firefox/libxul.so
(gdb) info args
No symbol table info available.

After logging in the device, I tried to load google's page.

[Switching to Thread 0x7fffbd266700 (LWP 17564)]

Thread 202 "SSL Cert #7" hit Breakpoint 1, 0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () from /home/moz/firefox/libxul.so
(gdb) 
Continuing.
[New Thread 0x7fffc66bd700 (LWP 17566)]
[Switching to Thread 0x7fffb9aff700 (LWP 17565)]

Thread 203 "SSL Cert #8" hit Breakpoint 1, 0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () from /home/moz/firefox/libxul.so
(gdb) 
Continuing.
[New Thread 0x7fffb7dbc700 (LWP 17567)]
[Switching to Thread 0x7fffbd266700 (LWP 17564)]

Thread 202 "SSL Cert #7" hit Breakpoint 1, 0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () from /home/moz/firefox/libxul.so
(gdb) 
Continuing.
[New Thread 0x7fffbd620700 (LWP 17569)]
[New Thread 0x7fffe48c0700 (LWP 17570)]
[Switching to Thread 0x7fffc66bd700 (LWP 17566)]

Thread 204 "SSL Cert #9" hit Breakpoint 1, 0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () from /home/moz/firefox/libxul.so
(gdb) 
Continuing.
[Thread 0x7fffc0aff700 (LWP 17527) exited]
[Switching to Thread 0x7fffe48c0700 (LWP 17570)]

Thread 207 "SSL Cert #11" hit Breakpoint 1, 0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () from /home/moz/firefox/libxul.so
(gdb) 
Continuing.
[New Thread 0x7fffc0aff700 (LWP 17574)]
[Switching to Thread 0x7fffbd266700 (LWP 17564)]

Thread 202 "SSL Cert #7" hit Breakpoint 1, 0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () from /home/moz/firefox/libxul.so
(gdb) 
Continuing.
[Switching to Thread 0x7fffc66bd700 (LWP 17566)]

Thread 204 "SSL Cert #9" hit Breakpoint 1, 0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () from /home/moz/firefox/libxul.so
(gdb) 
Continuing.
[Switching to Thread 0x7fffb9aff700 (LWP 17565)]

Thread 203 "SSL Cert #8" hit Breakpoint 1, 0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () from /home/moz/firefox/libxul.so
(gdb) 
Continuing.
[Switching to Thread 0x7fffe48c0700 (LWP 17570)]

Thread 207 "SSL Cert #11" hit Breakpoint 1, 0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () from /home/moz/firefox/libxul.so
(gdb) 
Continuing.
[Switching to Thread 0x7fffb7dbc700 (LWP 17567)]

Thread 205 "SSL Cert #10" hit Breakpoint 1, 0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () from /home/moz/firefox/libxul.so
(gdb) 
Continuing.
[Switching to Thread 0x7fffbd266700 (LWP 17564)]

Thread 202 "SSL Cert #7" hit Breakpoint 1, 0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () from /home/moz/firefox/libxul.so
(gdb) 
Continuing.
[Switching to Thread 0x7fffc66bd700 (LWP 17566)]

Thread 204 "SSL Cert #9" hit Breakpoint 1, 0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () from /home/moz/firefox/libxul.so
(gdb) 
Continuing.
[New Thread 0x7fffc1ebd700 (LWP 17575)]
[Switching to Thread 0x7fffb7dbc700 (LWP 17567)]

Thread 205 "SSL Cert #10" hit Breakpoint 1, 0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () from /home/moz/firefox/libxul.so
(gdb) 
Continuing.
[Switching to Thread 0x7fffb9aff700 (LWP 17565)]

Thread 203 "SSL Cert #8" hit Breakpoint 1, 0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () from /home/moz/firefox/libxul.so
(gdb) 
Continuing.
[Switching to Thread 0x7fffe48c0700 (LWP 17570)]

Thread 207 "SSL Cert #11" hit Breakpoint 1, 0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () from /home/moz/firefox/libxul.so
(gdb) 
Continuing.
[Switching to Thread 0x7fffbd266700 (LWP 17564)]

Thread 202 "SSL Cert #7" hit Breakpoint 1, 0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () from /home/moz/firefox/libxul.so
(gdb) 
Continuing.
[Switching to Thread 0x7fffb9aff700 (LWP 17565)]

Thread 203 "SSL Cert #8" hit Breakpoint 1, 0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () from /home/moz/firefox/libxul.so
(gdb) 
Continuing.
[Switching to Thread 0x7fffc66bd700 (LWP 17566)]

Thread 204 "SSL Cert #9" hit Breakpoint 1, 0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () from /home/moz/firefox/libxul.so
(gdb) 
Continuing.
[Switching to Thread 0x7fffb7dbc700 (LWP 17567)]

Thread 205 "SSL Cert #10" hit Breakpoint 1, 0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () from /home/moz/firefox/libxul.so
(gdb) 
Continuing.
[Switching to Thread 0x7fffbd266700 (LWP 17564)]

Thread 202 "SSL Cert #7" hit Breakpoint 1, 0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () from /home/moz/firefox/libxul.so
(gdb) 
Continuing.
[Thread 0x7fffbd620700 (LWP 17569) exited]
[Switching to Thread 0x7fffb9aff700 (LWP 17565)]

Thread 203 "SSL Cert #8" hit Breakpoint 1, 0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () from /home/moz/firefox/libxul.so
(gdb) 
Continuing.
[Switching to Thread 0x7fffe48c0700 (LWP 17570)]

Thread 207 "SSL Cert #11" hit Breakpoint 1, 0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () from /home/moz/firefox/libxul.so
(gdb) 
Continuing.
[Switching to Thread 0x7fffc66bd700 (LWP 17566)]

Thread 204 "SSL Cert #9" hit Breakpoint 1, 0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () from /home/moz/firefox/libxul.so
(gdb) 
Continuing.
[Switching to Thread 0x7fffb7dbc700 (LWP 17567)]

Thread 205 "SSL Cert #10" hit Breakpoint 1, 0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () from /home/moz/firefox/libxul.so
(gdb) 
Continuing.
[Switching to Thread 0x7fffbd266700 (LWP 17564)]

Thread 202 "SSL Cert #7" hit Breakpoint 1, 0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () from /home/moz/firefox/libxul.so
(gdb) 
Continuing.
[Switching to Thread 0x7fffb9aff700 (LWP 17565)]

Thread 203 "SSL Cert #8" hit Breakpoint 1, 0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () from /home/moz/firefox/libxul.so
(gdb) 
Continuing.
[Switching to Thread 0x7fffb7dbc700 (LWP 17567)]

Thread 205 "SSL Cert #10" hit Breakpoint 1, 0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () from /home/moz/firefox/libxul.so
(gdb) 
Continuing.
[Switching to Thread 0x7fffc66bd700 (LWP 17566)]

Thread 204 "SSL Cert #9" hit Breakpoint 1, 0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () from /home/moz/firefox/libxul.so
(gdb) 
Continuing.
[Switching to Thread 0x7fffbd266700 (LWP 17564)]

Thread 202 "SSL Cert #7" hit Breakpoint 1, 0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () from /home/moz/firefox/libxul.so
(gdb) 
Continuing.
[Switching to Thread 0x7fffb9aff700 (LWP 17565)]

Thread 203 "SSL Cert #8" hit Breakpoint 1, 0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () from /home/moz/firefox/libxul.so
(gdb) 
Continuing.
[Switching to Thread 0x7fffb7dbc700 (LWP 17567)]

Thread 205 "SSL Cert #10" hit Breakpoint 1, 0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () from /home/moz/firefox/libxul.so
(gdb) 
Continuing.
[Switching to Thread 0x7fffc66bd700 (LWP 17566)]

Thread 204 "SSL Cert #9" hit Breakpoint 1, 0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () from /home/moz/firefox/libxul.so
(gdb) 
Continuing.
[Switching to Thread 0x7fffbd266700 (LWP 17564)]

Thread 202 "SSL Cert #7" hit Breakpoint 1, 0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () from /home/moz/firefox/libxul.so
(gdb) 
Continuing.
[Switching to Thread 0x7fffe48c0700 (LWP 17570)]

Thread 207 "SSL Cert #11" hit Breakpoint 1, 0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () from /home/moz/firefox/libxul.so
(gdb) 
Continuing.
[Switching to Thread 0x7fffb9aff700 (LWP 17565)]

Thread 203 "SSL Cert #8" hit Breakpoint 1, 0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () from /home/moz/firefox/libxul.so
(gdb) 
Continuing.
[Switching to Thread 0x7fffc66bd700 (LWP 17566)]

Thread 204 "SSL Cert #9" hit Breakpoint 1, 0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () from /home/moz/firefox/libxul.so
(gdb) 
Continuing.
[Switching to Thread 0x7fffbd266700 (LWP 17564)]

Thread 202 "SSL Cert #7" hit Breakpoint 1, 0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () from /home/moz/firefox/libxul.so
(gdb) 
Continuing.
[Switching to Thread 0x7fffb7dbc700 (LWP 17567)]

Thread 205 "SSL Cert #10" hit Breakpoint 1, 0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () from /home/moz/firefox/libxul.so
(gdb) 
Continuing.
[Switching to Thread 0x7fffb9aff700 (LWP 17565)]

Thread 203 "SSL Cert #8" hit Breakpoint 1, 0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () from /home/moz/firefox/libxul.so
(gdb) 
Continuing.
[Switching to Thread 0x7fffbd266700 (LWP 17564)]

Thread 202 "SSL Cert #7" hit Breakpoint 1, 0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () from /home/moz/firefox/libxul.so
(gdb) 
Continuing.
[Switching to Thread 0x7fffc66bd700 (LWP 17566)]

Thread 204 "SSL Cert #9" hit Breakpoint 1, 0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () from /home/moz/firefox/libxul.so
(gdb) 
Continuing.
[Switching to Thread 0x7fffb9aff700 (LWP 17565)]

Thread 203 "SSL Cert #8" hit Breakpoint 1, 0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () from /home/moz/firefox/libxul.so
(gdb) 
Continuing.
[Switching to Thread 0x7fffb7dbc700 (LWP 17567)]

Thread 205 "SSL Cert #10" hit Breakpoint 1, 0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () from /home/moz/firefox/libxul.so
(gdb) 
Continuing.
[Switching to Thread 0x7fffbd266700 (LWP 17564)]

Thread 202 "SSL Cert #7" hit Breakpoint 1, 0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () from /home/moz/firefox/libxul.so
(gdb) 
Continuing.
[Switching to Thread 0x7fffe48c0700 (LWP 17570)]

Thread 207 "SSL Cert #11" hit Breakpoint 1, 0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () from /home/moz/firefox/libxul.so
(gdb) 
Continuing.
[Switching to Thread 0x7fffc66bd700 (LWP 17566)]

Thread 204 "SSL Cert #9" hit Breakpoint 1, 0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () from /home/moz/firefox/libxul.so
(gdb) 
Continuing.
[Switching to Thread 0x7fffbd266700 (LWP 17564)]

Thread 202 "SSL Cert #7" hit Breakpoint 1, 0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () from /home/moz/firefox/libxul.so
(gdb) 
Continuing.
[Switching to Thread 0x7fffb9aff700 (LWP 17565)]

Thread 203 "SSL Cert #8" hit Breakpoint 1, 0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () from /home/moz/firefox/libxul.so
(gdb) 

Various threads hit the breakpoint in an apparently random fashion for hundreds of times. Possibly more. Perhaps timeouts get in the way? I didn't reach the warning page. After squashing the <Enter> key for some time, I disabled the breakpoint and quit the program. It issued a few times an [ERROR viaduct::backend::ffi] Missing HTTP status before exiting.

Here are some backtraces:

Thread 225 "SSL Cert #14" hit Breakpoint 1, 0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () from /home/moz/firefox/libxul.so
(gdb) bt
#0  0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () at /home/moz/firefox/libxul.so
#1  0x00007ffff13288a6 in mozilla::pkix::BuildForward(mozilla::pkix::TrustDomain&, mozilla::pkix::BackCert const&, mozilla::pkix::Time, mozilla::pkix::KeyUsage, mozilla::pkix::KeyPurposeId, mozilla::pkix::CertPolicyId const&, mozilla::pkix::Input const*, unsigned int, unsigned int&) () at /home/moz/firefox/libxul.so
#2  0x00007ffff1328488 in mozilla::pkix::PathBuildingStep::Check(mozilla::pkix::Input, mozilla::pkix::Input const*, bool&) () at /home/moz/firefox/libxul.so
#3  0x00007fffeea74819 in mozilla::psm::CheckCandidates(mozilla::pkix::TrustDomain&, mozilla::pkix::TrustDomain::IssuerChecker&, nsTArray<mozilla::pkix::Input>&, mozilla::pkix::Input*, bool&) () at /home/moz/firefox/libxul.so
#4  0x00007fffeea73f07 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () at /home/moz/firefox/libxul.so
#5  0x00007ffff13288a6 in mozilla::pkix::BuildForward(mozilla::pkix::TrustDomain&, mozilla::pkix::BackCert const&, mozilla::pkix::Time, mozilla::pkix::KeyUsage, mozilla::pkix::KeyPurposeId, mozilla::pkix::CertPolicyId const&, mozilla::pkix::Input const*, unsigned int, unsigned int&) () at /home/moz/firefox/libxul.so
#6  0x00007ffff13289b7 in mozilla::pkix::BuildCertChain(mozilla::pkix::TrustDomain&, mozilla::pkix::Input, mozilla::pkix::Time, mozilla::pkix::EndEntityOrCA, mozilla::pkix::KeyUsage, mozilla::pkix::KeyPurposeId, mozilla::pkix::CertPolicyId const&, mozilla::pkix::Input const*) () at /home/moz/firefox/libxul.so
#7  0x00007fffeea7340f in mozilla::psm::BuildCertChainForOneKeyUsage(mozilla::psm::NSSCertDBTrustDomain&, mozilla::pkix::Input, mozilla::pkix::Time, mozilla::pkix::KeyUsage, mozilla::pkix::KeyUsage, mozilla::pkix::KeyUsage, mozilla::pkix::KeyPurposeId, mozilla::pkix::CertPolicyId const&, mozilla::pkix::Input const*, mozilla::psm::CertVerifier::OCSPStaplingStatus*) () at /home/moz/firefox/libxul.so
#8  0x00007fffeea727f0 in mozilla::psm::CertVerifier::VerifyCert(nsTArray<unsigned char> const&, long, mozilla::pkix::Time, void*, char const*, nsTArray<nsTArray<unsigned char> >&, unsigned int, mozilla::Maybe<nsTArray<nsTArray<unsigned char> > > const&, mozilla::Maybe<nsTArray<unsigned char> > const&, mozilla::Maybe<nsTArray<unsigned char> > const&, mozilla::OriginAttributes const&, mozilla::psm::EVStatus*, mozilla::psm::CertVerifier::OCSPStaplingStatus*, mozilla::psm::KeySizeStatus*, mozilla::psm::PinningTelemetryInfo*, mozilla::psm::CertificateTransparencyInfo*, bool*, bool*) () at /home/moz/firefox/libxul.so
#9  0x00007fffeea7362b in mozilla::psm::CertVerifier::VerifySSLServerCert(nsTArray<unsigned char> const&, mozilla::pkix::Time, void*, nsTSubstring<char> const&, nsTArray<nsTArray<unsigned char> >&, unsigned int, mozilla::Maybe<nsTArray<nsTArray<unsigned char> > > const&, mozilla::Maybe<nsTArray<unsigned char> > const&, mozilla::Maybe<nsTArray<unsigned char> > const&, mozilla::Maybe<mozilla::psm::DelegatedCredentialInfo> const&, mozilla::OriginAttributes const&, mozilla::psm::EVStatus*, mozilla::psm::CertVerifier::OCSPStaplingStatus*, mozilla::psm::KeySizeStatus*, mozilla::psm::PinningTelemetryInfo*, mozilla::psm::CertificateTransparencyInfo*, bool*, bool*) () at /home/moz/firefox/libxul.so
#10 0x00007fffeea890c0 in mozilla::psm::AuthCertificate(mozilla::psm::CertVerifier&, void*, nsTArray<unsigned char> const&, nsTArray<nsTArray<unsigned char> > const&, nsTSubstring<char> const&, mozilla::OriginAttributes const&, mozilla::Maybe<nsTArray<unsigned char> > const&, mozilla::Maybe<nsTArray<unsigned char> > const&, mozilla::Maybe<mozilla::psm::DelegatedCredentialInfo> const&, unsigned int, mozilla::pkix::Time, unsigned int, nsTArray<nsTArray<unsigned char> >&, mozilla::psm::EVStatus&, mozilla::psm::CertificateTransparencyInfo&, bool&, bool&) () at /home/moz/firefox/libxul.so
#11 0x00007fffeea8a03a in mozilla::psm::SSLServerCertVerificationJob::Run() () at /home/moz/firefox/libxul.so
#12 0x00007ffff0796946 in nsThreadPool::Run() () at /home/moz/firefox/libxul.so

Thread 203 "SSL Cert #8" hit Breakpoint 1, 0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () from /home/moz/firefox/libxul.so
(gdb) bt
#0  0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () at /home/moz/firefox/libxul.so
#1  0x00007ffff13288a6 in mozilla::pkix::BuildForward(mozilla::pkix::TrustDomain&, mozilla::pkix::BackCert const&, mozilla::pkix::Time, mozilla::pkix::KeyUsage, mozilla::pkix::KeyPurposeId, mozilla::pkix::CertPolicyId const&, mozilla::pkix::Input const*, unsigned int, unsigned int&) () at /home/moz/firefox/libxul.so
#2  0x00007ffff1328488 in mozilla::pkix::PathBuildingStep::Check(mozilla::pkix::Input, mozilla::pkix::Input const*, bool&) () at /home/moz/firefox/libxul.so
#3  0x00007fffeea74819 in mozilla::psm::CheckCandidates(mozilla::pkix::TrustDomain&, mozilla::pkix::TrustDomain::IssuerChecker&, nsTArray<mozilla::pkix::Input>&, mozilla::pkix::Input*, bool&) () at /home/moz/firefox/libxul.so
#4  0x00007fffeea74551 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () at /home/moz/firefox/libxul.so
#5  0x00007ffff13288a6 in mozilla::pkix::BuildForward(mozilla::pkix::TrustDomain&, mozilla::pkix::BackCert const&, mozilla::pkix::Time, mozilla::pkix::KeyUsage, mozilla::pkix::KeyPurposeId, mozilla::pkix::CertPolicyId const&, mozilla::pkix::Input const*, unsigned int, unsigned int&) () at /home/moz/firefox/libxul.so
#6  0x00007ffff1328488 in mozilla::pkix::PathBuildingStep::Check(mozilla::pkix::Input, mozilla::pkix::Input const*, bool&) () at /home/moz/firefox/libxul.so
#7  0x00007fffeea74819 in mozilla::psm::CheckCandidates(mozilla::pkix::TrustDomain&, mozilla::pkix::TrustDomain::IssuerChecker&, nsTArray<mozilla::pkix::Input>&, mozilla::pkix::Input*, bool&) () at /home/moz/firefox/libxul.so
#8  0x00007fffeea73f07 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () at /home/moz/firefox/libxul.so
#9  0x00007ffff13288a6 in mozilla::pkix::BuildForward(mozilla::pkix::TrustDomain&, mozilla::pkix::BackCert const&, mozilla::pkix::Time, mozilla::pkix::KeyUsage, mozilla::pkix::KeyPurposeId, mozilla::pkix::CertPolicyId const&, mozilla::pkix::Input const*, unsigned int, unsigned int&) () at /home/moz/firefox/libxul.so
#10 0x00007ffff13289b7 in mozilla::pkix::BuildCertChain(mozilla::pkix::TrustDomain&, mozilla::pkix::Input, mozilla::pkix::Time, mozilla::pkix::EndEntityOrCA, mozilla::pkix::KeyUsage, mozilla::pkix::KeyPurposeId, mozilla::pkix::CertPolicyId const&, mozilla::pkix::Input const*) () at /home/moz/firefox/libxul.so
#11 0x00007fffeea7340f in mozilla::psm::BuildCertChainForOneKeyUsage(mozilla::psm::NSSCertDBTrustDomain&, mozilla::pkix::Input, mozilla::pkix::Time, mozilla::pkix::KeyUsage, mozilla::pkix::KeyUsage, mozilla::pkix::KeyUsage, mozilla::pkix::KeyPurposeId, mozilla::pkix::CertPolicyId const&, mozilla::pkix::Input const*, mozilla::psm::CertVerifier::OCSPStaplingStatus*) () at /home/moz/firefox/libxul.so
#12 0x00007fffeea725bb in mozilla::psm::CertVerifier::VerifyCert(nsTArray<unsigned char> const&, long, mozilla::pkix::Time, void*, char const*, nsTArray<nsTArray<unsigned char> >&, unsigned int, mozilla::Maybe<nsTArray<nsTArray<unsigned char> > > const&, mozilla::Maybe<nsTArray<unsigned char> > const&, mozilla::Maybe<nsTArray<unsigned char> > const&, mozilla::OriginAttributes const&, mozilla::psm::EVStatus*, mozilla::psm::CertVerifier::OCSPStaplingStatus*, mozilla::psm::KeySizeStatus*, mozilla::psm::PinningTelemetryInfo*, mozilla::psm::CertificateTransparencyInfo*, bool*, bool*) () at /home/moz/firefox/libxul.so
#13 0x00007fffeea7362b in mozilla::psm::CertVerifier::VerifySSLServerCert(nsTArray<unsigned char> const&, mozilla::pkix::Time, void*, nsTSubstring<char> const&, nsTArray<nsTArray<unsigned char> >&, unsigned int, mozilla::Maybe<nsTArray<nsTArray<unsigned char> > > const&, mozilla::Maybe<nsTArray<unsigned char> > const&, mozilla::Maybe<nsTArray<unsigned char> > const&, mozilla::Maybe<mozilla::psm::DelegatedCredentialInfo> const&, mozilla::OriginAttributes const&, mozilla::psm::EVStatus*, mozilla::psm::CertVerifier::OCSPStaplingStatus*, mozilla::psm::KeySizeStatus*, mozilla::psm::PinningTelemetryInfo*, mozilla::psm::CertificateTransparencyInfo*, bool*, bool*) () at /home/moz/firefox/libxul.so
#14 0x00007fffeea890c0 in mozilla::psm::AuthCertificate(mozilla::psm::CertVerifier&, void*, nsTArray<unsigned char> const&, nsTArray<nsTArray<unsigned char> > const&, nsTSubstring<char> const&, mozilla::OriginAttributes const&, mozilla::Maybe<nsTArray<unsigned char> > const&, mozilla::Maybe<nsTArray<unsigned char> > const&, mozilla::Maybe<mozilla::psm::DelegatedCredentialInfo> const&, unsigned int, mozilla::pkix::Time, unsigned int, nsTArray<nsTArray<unsigned char> >&, mozilla::psm::EVStatus&, mozilla::psm::CertificateTransparencyInfo&, bool&, bool&) () at /home/moz/firefox/libxul.so
#15 0x00007fffeea8a03a in mozilla::psm::SSLServerCertVerificationJob::Run() () at /home/moz/firefox/libxul.so
#16 0x00007ffff0796946 in nsThreadPool::Run() () at /home/moz/firefox/libxul.so

Thread 203 "SSL Cert #8" hit Breakpoint 1, 0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () from /home/moz/firefox/libxul.so
(gdb) bt
#0  0x00007fffeea73be4 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () at /home/moz/firefox/libxul.so
#1  0x00007ffff13288a6 in mozilla::pkix::BuildForward(mozilla::pkix::TrustDomain&, mozilla::pkix::BackCert const&, mozilla::pkix::Time, mozilla::pkix::KeyUsage, mozilla::pkix::KeyPurposeId, mozilla::pkix::CertPolicyId const&, mozilla::pkix::Input const*, unsigned int, unsigned int&) () at /home/moz/firefox/libxul.so
#2  0x00007ffff1328488 in mozilla::pkix::PathBuildingStep::Check(mozilla::pkix::Input, mozilla::pkix::Input const*, bool&) () at /home/moz/firefox/libxul.so
#3  0x00007fffeea74819 in mozilla::psm::CheckCandidates(mozilla::pkix::TrustDomain&, mozilla::pkix::TrustDomain::IssuerChecker&, nsTArray<mozilla::pkix::Input>&, mozilla::pkix::Input*, bool&) () at /home/moz/firefox/libxul.so
#4  0x00007fffeea73f07 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () at /home/moz/firefox/libxul.so
#5  0x00007ffff13288a6 in mozilla::pkix::BuildForward(mozilla::pkix::TrustDomain&, mozilla::pkix::BackCert const&, mozilla::pkix::Time, mozilla::pkix::KeyUsage, mozilla::pkix::KeyPurposeId, mozilla::pkix::CertPolicyId const&, mozilla::pkix::Input const*, unsigned int, unsigned int&) () at /home/moz/firefox/libxul.so
#6  0x00007ffff1328488 in mozilla::pkix::PathBuildingStep::Check(mozilla::pkix::Input, mozilla::pkix::Input const*, bool&) () at /home/moz/firefox/libxul.so
#7  0x00007fffeea74819 in mozilla::psm::CheckCandidates(mozilla::pkix::TrustDomain&, mozilla::pkix::TrustDomain::IssuerChecker&, nsTArray<mozilla::pkix::Input>&, mozilla::pkix::Input*, bool&) () at /home/moz/firefox/libxul.so
#8  0x00007fffeea73f07 in mozilla::psm::NSSCertDBTrustDomain::FindIssuer(mozilla::pkix::Input, mozilla::pkix::TrustDomain::IssuerChecker&, mozilla::pkix::Time) () at /home/moz/firefox/libxul.so
#9  0x00007ffff13288a6 in mozilla::pkix::BuildForward(mozilla::pkix::TrustDomain&, mozilla::pkix::BackCert const&, mozilla::pkix::Time, mozilla::pkix::KeyUsage, mozilla::pkix::KeyPurposeId, mozilla::pkix::CertPolicyId const&, mozilla::pkix::Input const*, unsigned int, unsigned int&) () at /home/moz/firefox/libxul.so
#10 0x00007ffff13289b7 in mozilla::pkix::BuildCertChain(mozilla::pkix::TrustDomain&, mozilla::pkix::Input, mozilla::pkix::Time, mozilla::pkix::EndEntityOrCA, mozilla::pkix::KeyUsage, mozilla::pkix::KeyPurposeId, mozilla::pkix::CertPolicyId const&, mozilla::pkix::Input const*) () at /home/moz/firefox/libxul.so
#11 0x00007fffeea7340f in mozilla::psm::BuildCertChainForOneKeyUsage(mozilla::psm::NSSCertDBTrustDomain&, mozilla::pkix::Input, mozilla::pkix::Time, mozilla::pkix::KeyUsage, mozilla::pkix::KeyUsage, mozilla::pkix::KeyUsage, mozilla::pkix::KeyPurposeId, mozilla::pkix::CertPolicyId const&, mozilla::pkix::Input const*, mozilla::psm::CertVerifier::OCSPStaplingStatus*) () at /home/moz/firefox/libxul.so
#12 0x00007fffeea727f0 in mozilla::psm::CertVerifier::VerifyCert(nsTArray<unsigned char> const&, long, mozilla::pkix::Time, void*, char const*, nsTArray<nsTArray<unsigned char> >&, unsigned int, mozilla::Maybe<nsTArray<nsTArray<unsigned char> > > const&, mozilla::Maybe<nsTArray<unsigned char> > const&, mozilla::Maybe<nsTArray<unsigned char> > const&, mozilla::OriginAttributes const&, mozilla::psm::EVStatus*, mozilla::psm::CertVerifier::OCSPStaplingStatus*, mozilla::psm::KeySizeStatus*, mozilla::psm::PinningTelemetryInfo*, mozilla::psm::CertificateTransparencyInfo*, bool*, bool*) () at /home/moz/firefox/libxul.so
#13 0x00007fffeea7362b in mozilla::psm::CertVerifier::VerifySSLServerCert(nsTArray<unsigned char> const&, mozilla::pkix::Time, void*, nsTSubstring<char> const&, nsTArray<nsTArray<unsigned char> >&, unsigned int, mozilla::Maybe<nsTArray<nsTArray<unsigned char> > > const&, mozilla::Maybe<nsTArray<unsigned char> > const&, mozilla::Maybe<nsTArray<unsigned char> > const&, mozilla::Maybe<mozilla::psm::DelegatedCredentialInfo> const&, mozilla::OriginAttributes const&, mozilla::psm::EVStatus*, mozilla::psm::CertVerifier::OCSPStaplingStatus*, mozilla::psm::KeySizeStatus*, mozilla::psm::PinningTelemetryInfo*, mozilla::psm::CertificateTransparencyInfo*, bool*, bool*) () at /home/moz/firefox/libxul.so
#14 0x00007fffeea890c0 in mozilla::psm::AuthCertificate(mozilla::psm::CertVerifier&, void*, nsTArray<unsigned char> const&, nsTArray<nsTArray<unsigned char> > const&, nsTSubstring<char> const&, mozilla::OriginAttributes const&, mozilla::Maybe<nsTArray<unsigned char> > const&, mozilla::Maybe<nsTArray<unsigned char> > const&, mozilla::Maybe<mozilla::psm::DelegatedCredentialInfo> const&, unsigned int, mozilla::pkix::Time, unsigned int, nsTArray<nsTArray<unsigned char> >&, mozilla::psm::EVStatus&, mozilla::psm::CertificateTransparencyInfo&, bool&, bool&) () at /home/moz/firefox/libxul.so
#15 0x00007fffeea8a03a in mozilla::psm::SSLServerCertVerificationJob::Run() () at /home/moz/firefox/libxul.so
#16 0x00007ffff0796946 in nsThreadPool::Run() () at /home/moz/firefox/libxul.so

The last two look identical except for the addresses at frames 4 and 12.

You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: