2003189 - Extra space at the beginning of label OISTE Server Root RSA G1

Status: RESOLVED FIXED

(NSS :: CA Certificates Code, defect, P5)

Description

[Airat Makhmutov]

Steps to reproduce:

I compared the label of the certificates obtained through

certutil -N --empty-password -d nssdb
certutil -L -d nssdb -h 'Builtin Object Token'

with another program.
The problem was when updating nss from 3.115 to 3.118.1

See https://github.com/nss-dev/nss/commit/c14fe8ae4a84088179f136998957e7d7f644ee94#diff-5ef09190f7af20ee97bdd76fbd5cf1d0b80d1a5c71cf8b22519079ff37365abbR26752-R27158

In my opinion instead of the

CKA_LABEL UTF8 " OISTE Server Root RSA G1"

should be

CKA_LABEL UTF8 "OISTE Server Root RSA G1"

Actual results:

Output:

Default Trust:TunTrust Root CA                               C,,  
Default Trust:UCA Extended Validation Root                   C,,  
Default Trust:UCA Global G2 Root                             C,C, 
Default Trust:USERTrust ECC Certification Authority          C,C, 
Default Trust:USERTrust RSA Certification Authority          C,C, 
Default Trust:XRamp Global CA Root                           ,C,  
Default Trust:OISTE Server Root RSA G1                      C,,  
Default Trust:certSIGN ROOT CA                               C,,  
Default Trust:certSIGN Root CA G2                            C,,  
Default Trust:e-Szigno Root CA 2017                          C,C, 
Default Trust:ePKI Root Certification Authority              C,C

Expected results:

Expected output

Default Trust:TunTrust Root CA                               C,,  
Default Trust:UCA Extended Validation Root                   C,,  
Default Trust:UCA Global G2 Root                             C,C, 
Default Trust:USERTrust ECC Certification Authority          C,C, 
Default Trust:USERTrust RSA Certification Authority          C,C, 
Default Trust:XRamp Global CA Root                           ,C,  
Default Trust:OISTE Server Root RSA G1                      C,,  
Default Trust:certSIGN ROOT CA                               C,,  
Default Trust:certSIGN Root CA G2                            C,,  
Default Trust:e-Szigno Root CA 2017                          C,C, 
Default Trust:ePKI Root Certification Authority              C,C

Comment 1

[Airat Makhmutov]

* Output:

Default Trust:TunTrust Root CA                               C,,  
Default Trust:UCA Extended Validation Root                   C,,  
Default Trust:UCA Global G2 Root                             C,C, 
Default Trust:USERTrust ECC Certification Authority          C,C, 
Default Trust:USERTrust RSA Certification Authority          C,C, 
Default Trust:XRamp Global CA Root                           ,C,  
Default Trust: OISTE Server Root RSA G1                      C,,  
Default Trust:certSIGN ROOT CA                               C,,  
Default Trust:certSIGN Root CA G2                            C,,  
Default Trust:e-Szigno Root CA 2017                          C,C, 
Default Trust:ePKI Root Certification Authority              C,C,

Comment 2

[John Schanck [:jschanck]]

What is the other program that you're referring to?

My inclination would be to leave this as is. The leading space is not causing any problems, but the risk of breaking some downstream consumer of the trust module by changing the label is non-zero.

Comment 3

[Airat Makhmutov]

(In reply to John Schanck [:jschanck] from comment #2)

What is the other program that you're referring

p11-kit (https://github.com/p11-glue/p11-kit). It turns out that when comparing the names, we erased the extra spaces at the beginning of the names in the output of the p11-kit. It has already been fixed on our part: https://git.altlinux.org/gears/p/p11-kit.git?p=p11-kit.git;a=commitdiff;h=9db2347c20818e150d05308904d7b7ba1394bd2a.

My inclination would be to leave this as is. The leading space is not causing any problems, but the risk of breaking some downstream consumer of the trust module by changing the label is non-zero.

OK, let's leave it as it is, I don't mind. I just wanted you to know that such a thing exists.

Comment 4

[Yungchen Jen]

(In reply to John Schanck [:jschanck] from comment #2)

What is the other program that you're referring to?

My inclination would be to leave this as is. The leading space is not causing any problems, but the risk of breaking some downstream consumer of the trust module by changing the label is non-zero.

The expiry date of the aforementioned certificate is 24 May 2048. Based on what you said, can I imply that this visual bug will be with us in the next 22 years?

As per Bug 1936279, the OISTE was introduced into FF merely two months ago. IMHO, we should fix it before it causes any bigger issue in the future.

Comment 5

[Yungchen Jen]

Attachment: The highlighted line with an extra whitespace

Comment 6

[John Schanck [:jschanck]]

We could potentially trim whitespace from names when they're presented in the certificate manager. But I don't think we should change the name in the builtin roots module.

Comment 8

[Dana Keeler (she/her) [:keeler]]

I'm concerned trimming the label in the certificate manager could lead to confusion when the trimmed label doesn't work with other NSS tools, so it's probably best to just leave it. I realize it looks annoying.

Comment 9

[Dennis Jackson]

This was my typo, I think we can just fix the name in certdata.txt. Thank you for flagging.

Comment 10

[Dennis Jackson]

Attachment: Bug 2003189 - Fix errant whitespace in OISTE Server Root RSA G1 nickname. r=#nss-reviewers

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/projects/nss/rev/76e6887ecc1a
Fix errant whitespace in OISTE Server Root RSA G1 nickname. r=nss-reviewers,nkulatova