188986 - OCSP check fails with "date in the future" error if system clock is a minute slow

Status: RESOLVED WORKSFORME

(Core Graveyard :: Security: UI, defect, P3)

Description

[mlenz]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.0.2) Gecko/20021216
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.0.2) Gecko/20021216

If OCSP checking is enabled, going to a web site that has an OCSP responder when
your system clock is more than a minute slow, you get "Error trying to validate
- response contains a date which is in the future."


Reproducible: Always

Steps to Reproduce:
1. enable OCSP validation
2. set clock back a few minutes
3. go to http://www.etrade.com or https://digitalid.verisign.com/

Actual Results:  
OCSP error and site fails to load.

Expected Results:  
No error - OCSP should not be so highly dependent on the clock on the client
machine.

Comment 1

[John Unruh]

Confirming with the Jan 13 Win2000 commercial trunk build.

Comment 2

[Wild Willy Kredentser]

I think Bugs 224443, 220740, 224593, & 188986 are duplicates.

Comment 3

[Nelson Bolyard (seldom reads bugmail)]

*** Bug 224443 has been marked as a duplicate of this bug. ***

Comment 4

[Nelson Bolyard (seldom reads bugmail)]

In answer to Wild Willy's  comment 2: 
bug 224443, bug 220740, and bug 224593 all occurred on OS/2, and the problem
was apparently fixed by the application of an OS/2 patch (see those bugs for 
details).  
This bug, bug 188986 claims to occur on Win2k, and so it is doubtful that 
the OS/2 patch fixes it.  :)

Question for mlenz, the reporter:  
Do you see this bug with more recent versions of mozilla?
I have been told that this bug, intolerance of small clock differences 
in OCSP responses, has been fixed.  Can you confirm?

Comment 5

[John G. Myers]

Mass reassign ssaux bugs to nobody

Comment 6

[Kai Engert (:KaiE:)]

As nobody has given updates since Nelson asked for feedback over a year ago, and as we have the suspicion the bug was fixed, I'm resolving it as WORKSFORME.