1849744 - Sites serving revoked TLS certificates

Status: NEW

(Web Compatibility :: Knowledge Base, defect)

Description

[Dennis Schubert [:denschub]]

Some sites do serve TLS certificates that have been revoked, but they still work in Chrome. The difference between browsers here will probably go away after bug 1429800, but for now, let's track those cases.

Comment 1

[John Schanck [:jschanck]]

For what it's worth, CRLite will probably increase the differences between browsers. CRLite is a more effective revocation checking tool than OCSP (about 10% of OCSP checks fail due to network errors), and we're the only browser that has a CRLite implementation.

Comment 2

[Dennis Schubert [:denschub]]

Oh, then I missed something - I thought it would bring us closer to what Chrome does. Oh well. Then it's even better to keep track of those things. Thanks for the clarification! :)

Comment 3

[Thorin [:thorin]]

FYI, the reverse scenario: CRLite allows a revoked cert whilst OCSP doesn't:

• link (misleading title): https://old.reddit.com/r/firefox/comments/1ayqhvc/crlite_not_recognizing_revoked_certificate/
• I can replicate OCSP-off and CRLite-on - https://digicert-tls-ecc-p384-root-g5-revoked.chain-demos.digicert.com

Comment 4

[portbackward]

I can confirm what Simon describes.

I'm not warned when clicking on the 2nd link with CRLite enabled and OCSP disabled (Followed steps mentioned via 1st link).
With OCSP enabled I'm warned by the 2nd link, I would expect that CRLite alone would also recognize revoked certificates.

Comment 5

[portbackward]

Just recognized CRLite was updated and the issue mentioned my Simon is fixed.
Firefox now recognized the DigiCert site to be as revoked, based on CRLite.
Thanks so much Mozilla!

Comment 6

[portbackward]

CRLite seems broken again at the moment.

Following websites are opened and no warning is shown with CRLite enabled:
https://digicert-tls-ecc-p384-root-g5-revoked.chain-demos.digicert.com/
http://revoked.grc.com/

Comment 7

[John Schanck [:jschanck]]

I receive a warning on https://revoked.grc.com/ but not on https://digicert-tls-ecc-p384-root-g5-revoked.chain-demos.digicert.com/.

Neither certificate appears to be covered by the current CRLite filter, but Firefox should fall back to OCSP when that happens.

https://crt.sh/?id=14138518440&opt=ocsp shows that the digicert-tls-ecc-p384-root-g5-revoked certificate was revoked very recently, and OCSP servers are allowed to cache results for several days. So I suspect this will resolve itself shortly.

Comment 8

[portbackward]

I receive no warning for both sites, with all my CRLite files were updated today.
A few months ago when I tested both sites were successfully shown as revoked via CRLite.

OCSP is disabled on my Firefox config and CRLite is enforced via about:config on my client:
security.pki.crlite_mode = 2
security.remote_settings.crlite_filters.enabled = true

Comment 9

[portbackward]

Firefox is now correctly notifying, that the cert for both sites is revoked via CRLite only.
Seems CRLite is working again, thanks a lot!