1802499 - SSL_ERROR_EXPIRED_CERT_ALERT, but Zertificate chain looks OK

Status: RESOLVED DUPLICATE of bug 1220129

(Core :: Security: PSM, defect)

Description

[Ulrich Windl]

Attachment: Screen recording showing the error message, connection status and certificate chain

Steps to reproduce:

Connect to a site I did connect before using Firefox 102.4.0esr (64-bit) on Windows 10

Actual results:

I got an SSL_ERROR_EXPIRED_CERT_ALERT, but the certificate chain looks OK.
On closer inspections it seems that the user certificate had expired. Actually the certificate was renewed and stored in Firefox, but Firefox seems not to consider the newer certificate, or ask the user about it.
Actually I have no idea other than restarting Firefox to change the user certificate.

Expected results:

SSL_ERROR_EXPIRED_CERT_ALERT should only be triggered if a certificate is expired, or the expired certificate should be displayed.

Comment 1

[Ulrich Windl]

Attachment: List of user certificates (replacing each other)

The user certificates all have the same subject, but different validity intervals. Possibly there is an overlap of a few days between the two most recent user certificates.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::Networking' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 3

[Ulrich Windl]

I found the root cause of the problem: Under the well-hidden "Authentication Decisions" there was the expired user certificate (twice for some reason)
After removing those entries, Firefox asked again which certificate to use (it suggested only one; the right one).
Then authentication succeeded.

So the original error message is very much confusing, and there is very little useful advice how the user can resolve such a problem!