1806393 - Use non-empty password for p12 test files used by Thunderbird

Status: RESOLVED FIXED

(NSS :: Test, enhancement)

Description

[Kai Engert [:KaiE:]]

The script that generates test p12 files for Thunderbird uses an empty password.

When I attempted to refresh Thunderbird's test S/MIME certificates (bug 1805848), I ran into a new test failure.

The reason is that the PSM code apparently fails to import the new p12 file with error code -8113 - SEC_ERROR_PKCS12_INVALID_MAC. But only certain combinations fail. It's surprising. Here are test results:

Thunderbird 102.x (NSS 3.79) importing old p12 file: works
Thunderbird 102.x (NSS 3.79) importing new p12 file: fails !

Thunderbird 109 Beta (NSS 3.86) importing old p12 file: works
Thunderbird 109 Beta (NSS 3.86) importing new p12 file: fails !

certutil (NSS 3.85 Fedora) importing old p12 file: works
certutil (NSS 3.85 Fedora) importing new p12 file: works !

Because I cannot immediately find the cause, I've tested with a non-empty password.
That works fine in the above failure scenario.

Comment 1

[Kai Engert [:KaiE:]]

Attachment: old-good.p12

Comment 2

[Kai Engert [:KaiE:]]

Attachment: new-bad.p12

Comment 3

[Kai Engert [:KaiE:]]

Attachment: old-ca.pem

Comment 4

[Kai Engert [:KaiE:]]

Attachment: new-ca.pem

Comment 5

[Kai Engert [:KaiE:]]

To be able to move on, I'll change the test scripts to use a non-empty password.

Comment 6

[Kai Engert [:KaiE:]]

Attachment: Bug 1806393 - Use non-empty password for p12 test files used by Thunderbird. r=bbeurdouche

Comment 7

[Kai Engert [:KaiE:]]

https://hg.mozilla.org/projects/nss/rev/3b69196a315ae2bd408aec0df2eb147b6a806bf4