1911893 - make certificate revocation error pages more informative

Status: NEW

(Firefox :: Security, enhancement, P2)

Description

[bugzilla-fromthedeep]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:129.0) Gecko/20100101 Firefox/129.0

Steps to reproduce:

browsed to my enterprise hosted github site. This is an internal site, so I cannot share it here.

Actual results:

I could not connect -- I got SEC_ERROR_REVOKED_CERTIFICATE

which doesn't make any sense -- the certificate on this site doesn't expire until November.

Expected results:

I should have connected just like I have always been able to until this update. I turned off OCSP and I was able to connect just fine.

This feature should be disabled until it does something useful.

Comment 1

[BugBot [:suhaib / :marco]]

The Bugbug bot thinks this bug should belong to the 'Firefox::Security' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[bugzilla-fromthedeep]

note -- it looks like the ocsp issue is real. I should still be able to add an exception and connect anyway if I know what the issue is, so the implementation should be changed.

Comment 3

[Manuel Bucher [:manuel] {{ FYI: OOO Jul 30 - Aug 16 }}]

It is not a bug that the certificate error page is displayed. However there are things we can change here. Displaying a more descriptive error page in case of revoked certificates from recent CA compliance incidents like Digicert revoking lots of certificates with a link to an article that informs users would be great. Especially because compared to Chrome, Firefox is more strict with respect to certificate revocation checking. Firefox uses OCSP to actively look up certificate revocation status, while Chrome does not.

A more descriptive error page that explains why Firefox is protecting the user would probably help too in the general case. Additionally having an "Add exception" button would be great if users would otherwise disable security.ocsp. Having a rational of why the button is missing in this error case would be great. I haven't found the rational for it yet.

Comment 4

[Dana Keeler (she/her) [:keeler]]

Revocation is not something we want to allow users to override. It's a signal that something is wrong with the certificate and it shouldn't be used (for example, the associated private key may have been compromised, allowing an attacker to impersonate the site and steal the user's data).

Comment 5

[Simon Friedberger [:simonf]]

Having "light" failures like "expired yesterday" which are handled less strictly - for example by having a "connect anyway" button - might be useful.

Comment 6

[Neha Kochar [:neha]]

(In reply to Simon Friedberger (:simonf) from comment #5)

Having "light" failures like "expired yesterday" which are handled less strictly - for example by having a "connect anyway" button - might be useful.

FYI: Similar suggestion (but for HSTS) in https://bugzilla.mozilla.org/show_bug.cgi?id=1437498