Open
Bug 2087030
Opened 1 day ago
Updated 3 hours ago
CERT_NewTempCertificate rejects certificates with third-party public key algorithms
Categories
(NSS :: Libraries, defect)
Tracking
(firefox-esr153 unaffected, firefox159 unaffected, firefox160 unaffected, firefox161 unaffected)
NEW
| Tracking | Status | |
|---|---|---|
| firefox-esr153 | --- | unaffected |
| firefox159 | --- | unaffected |
| firefox160 | --- | unaffected |
| firefox161 | --- | unaffected |
People
(Reporter: rautyrauty, Assigned: keeler)
References
Details
(Keywords: regression, Whiteboard: [nss-nofx])
Attachments
(1 external file, 1 obsolete file)
Steps to reproduce
- Change a certificate's SubjectPublicKeyInfo algorithm OID to an unallocated value.
- Call CERT_NewTempCertificate with the resulting certificate.
Actual result
CERT_NewTempCertificate returns NULL with SEC_ERROR_UNSUPPORTED_KEYALG.
Expected result
The certificate is accepted so a third-party PKCS#11 module can use its public key, as in NSS 3.128.
Reproduced on NSS 3.132, ALT Linux p11.
|
||
Updated•1 day ago
|
status-firefox159:
--- → wontfix
status-firefox160:
--- → wontfix
status-firefox161:
--- → affected
status-firefox-esr153:
--- → unaffected
Flags: needinfo?(dkeeler)
Keywords: regression
|
Reporter | |
Comment 1•1 day ago
|
||
This is a regression from bug 1951159. Requiring a certificate key ID
at creation rejects certificates whose public key algorithm is handled
by a third-party PKCS#11 module but unknown to NSS.
|
||
Updated•1 day ago
|
Attachment #9671128 -
Attachment description: WIP: Bug 2087030 - Accept certificates with unknown key algorithms → Bug 2087030 - Accept certificates with unknown key algorithms
|
||
Comment 2•13 hours ago
|
||
The bug has a release status flag that shows some version of Firefox is affected, thus it will be considered confirmed.
Status: UNCONFIRMED → NEW
Ever confirmed: true
|
Assignee | |
Comment 3•4 hours ago
|
||
|
|
Assignee | |
Updated•3 hours ago
|
Assignee: nobody → dkeeler
Flags: needinfo?(dkeeler)
Whiteboard: [nss-nofx]
|
|
Assignee | |
Updated•3 hours ago
|
|
|
Assignee | |
Updated•3 hours ago
|
Attachment #9671128 -
Attachment is obsolete: true
You need to log in
before you can comment on or make changes to this bug.
Description
•