207892 - "invalid certificate" message when sending the 3rd message over SSL

Status: RESOLVED INVALID

(Core Graveyard :: Security: UI, defect)

Description

[Klaus Ridder]

User-Agent:       Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.4) Gecko/20030529

An SSL certificate, which is accepted for the first message, is rejected when 
sending the 2nd or 3rd eMail. I deleted the certificate several times and 
reproduced the bug. It doesn't always occcur, but most times. One time I was 
able to send 5 messages to [e-mail], but [e-mail] was then 
rejected.

Reproducible: Sometimes

Steps to Reproduce:
1. set outgoing smtp server to mail.canadatux.org, use SSL: always
2. send a message to [e-mail], Accept certificate. Mail will be 
successfully sent.
3. send another two messages to [e-mail]
4. if no error occurs, send a message to [e-mail]
5. At least now you should get the error message: "You have received an 
invalid certificate. It contains the same issuer name and serial number as 
another certificate that you are already using. Please contact the server 
administrator or email correspondent from which this invalid certificate came, 
and urge them to get a valid certificate."




The system administrator of canadatux.org, Matthias Hensler, assured that the 
certificate is correct. I will add him to this bug so he gets the 
correspondance. You can send mails to <anything>@kridder.de to this server 
without a login, but using the certificate.

Comment 1

[Matthias Versen [:Matti]]

-> PSM

Comment 2

[Nelson Bolyard (seldom reads bugmail)]

Is this still reproducible with recent mozilla nightly builds?

Comment 3

[John G. Myers]

The error message indicates duplicate serial numbers.  If you disagree, please
demonstrate that they have different serial numbers by attaching the certs for
both delete and test1.