197777 - Full certificate hierarchy not shown

Status: RESOLVED WORKSFORME

(Core Graveyard :: Security: UI, defect)

Description

[Henrik Gemal]

if you go to https://www.certifikat.dk
and view the security tab of the page info to view the certificate hierarchy
you'll see that it's:
SSL Server CA
  www.certifikat.dk

BUT if you use IE its shown as:
GlobalSign Root CA
  GlobalSign Partners CA
    SSL Server CA
      www.certifikat.dk

Why it Mozilla not showing GlobalSign?

20030314

Comment 1

[John Unruh]

Works for me with the March 4 commercial Win2000 trunk build.

Comment 2

[Henrik Gemal]

I dont really understand. Using 20030317 I get two different certificate
hierarchies if I compare with IE. Attaching screenshot...

Comment 3

[Henrik Gemal]

Attachment: screenshot

Comment 4

[XandreX]

I see the complete certification path on:
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.3b) Gecko/20030210

Comment 5

[Henrik Gemal]

with "complete certification" you mean:

GlobalSign Root CA
  GlobalSign Partners CA
    SSL Server CA
      www.certifikat.dk

?

Comment 6

[Stephane Saux]

Henrik, I suspect you're using a profile created with an earlier version of Moz
which didn't have the Global Sign Root CA in it. In addition, that earlier
version of Moz is still on your system.

The code will use the built in roots from the version that created the profile
is that version is still around, and it not, will use the verstion of the roots
from the currently running instance.

I can see all the certification path when I go to that site.

You can test my hypothesis by taking a look at root module in the device
manager. If the path for the roots is not that of the current installation, then
I'm correct.

You can then remedy this problem by either deleting or moving the old
installation. You can also remove the secmod.db file in the profile in question.
It will be recreated by the current version.

Comment 7

[Henrik Gemal]

>You can also remove the secmod.db file in the profile in question.
>It will be recreated by the current version.

removing secmod.db does not work. Using latest nightly build.
I have to remove cert8.db but then I also remove all my cert.

Can you descript what the different files does and their relations to eachother?
- cert7.db
- cert8.db
- key3.db
- secmod.db
- cert8.dir directory

Comment 8

[Stephane Saux]

NSS recently updated the format of its certificate database. When you start
mozilla equipped with this new version, it migrates the content of your cert7.db
into cert8.db. cert7.db is kept around in case you run this profile with an old
version.   Certs added with an old version are added to cert7.db, certs added
with a new version are added to cert8.db. This is a one time migration.

cert7/8.db contain only non-buit-in certificates: yours (not the keys), others
(s/mimes), ssl certs you decided to remember, intermediate ca you obtain via
normal s/mime operations, and roots you've manually loaded.  In addition,
cert7.db (but not cert8.db) contain CRLs and other large objects.

cert8.dir was created when you migrated cert7.db into cert8.db. The large
objects (CRLs) were put in there.

secmod.db records the modules (crypto devices) loaded in your profile. Among
those are the built-in roots.

key3.db contains your private keys.

I'm surprised that removing secmod.db didn't solve your problem. Did you stop
the application before removing it and restarted it?
Have you tried the other suggestion (look at where the root module point (where
is the nssckbi.dll library)? 

Another option is to "Backup all" your certs and remove all the files you
mentioned. (you may want to save them somewhere) there may be another bug involved.