184663 - Add more user dialog to processing of application/x-x509-ca-cert

Status: RESOLVED WONTFIX

(Core Graveyard :: Security: UI, defect)

Description

[Ralf Hauser]

I clicked on the above URL and I got the warning: "The Certificate already
exists" (I assume the personal
security manager had my password cached).

I assume that the certificate it tried to import was already there (based on
what criteria just the same e-mail address or certificate ID or even same
expiration since there is apparently "renewal"?), but for me as a user, it would
be very helpful if
1) It would be displayed what the certificate is about (purpose, issued to,
validity, issuer, etc.).
2) to which tab of my security manager (Your certificates, Other people's,
Websites, *probably* Authorities) the certificate will go
3) Provide me with the options (Re-Import - Save As - Cancel - show existing one
- ...)

Comment 1

[Kai Engert (:KaiE:)]

I think re-import is not necessary.
Save as can be achived by using "right click save link target as" in the first
place.
Cancel is not necessary since no action happened.

However, I think we have a duplicate bug that suggests to give better feedback
in the "already exists" ca cert situation, and I suggest to dupe this bug to it.

Comment 2

[Ralf Hauser]

Agreed, "Cancel" probably should be labeled "Close".
I guess - re-import may be useful if somebody thinks the certificate currently
in the certificate manager is corrupted and needs to be overwritten. Or
(provided that that exists at all with x509) when certificates are
renewed/extended and still are considered to be the same (by virtue of e-mail
address, Issuee, ID, ...).

Sure, "save link as" can always be done, but if you display what the certificate
is all about anyway, why not offer a "Save As" button instead of forcing users
to first use the back-button and then use obscure right-mouse-click tricks.
Otherwise, following that line of thought why did Mozilla get implemented in the
first place, you can do all it does also with lynx or emacs, and other command
line hacker tools ...

Also, I suggest NOT to put it as a duplicate to the bug that suggests to give
better feedback in the "already exists" ca cert situation because I would have
made my suggestion even if my certificate hadn't existed before and thus had not
caused that minimalistic error message. My suggestions 1), 2) and parts of 3)
still apply with not yet existing certificates.

Comment 3

[Nelson Bolyard (seldom reads bugmail)]

I would go so far as to suggest that if the user is attempting to download
a cert that he already possesses, it should simply behave as if the download
and import had succeeded.  

Comment 4

[John G. Myers]

Mass reassign ssaux bugs to nobody