239567 - Unable to delete certificate authorities.

Status: RESOLVED DUPLICATE of bug 222139

(Core Graveyard :: Security: UI, defect)

Description

[Mike Hoye]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.6) Gecko/20040327 Firefox/0.8
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.6) Gecko/20040327 Firefox/0.8

If I decide that I don't trust verisign, or AOL, or whoever, I am unable to
delete their certificate via the "certificate manager" dialog. It shows as being
deleted, but closing that window and reopens it shows the deleted certificates
back on the list.

Reproducible: Always
Steps to Reproduce:
1. Delete some/all "authority" certs from the certificate manager
2. Click OK, reopen cert manager window.
3. There they all are, again.

Actual Results:  
Deleted authority certs were left in.

Expected Results:  
Deleted those certs. 

Whether or not you think doing so is a good idea, if a user can't revoke root
certs there's really no point to having that dialog there, or any
user-accessible PKI-related bits in the browser at all.

Comment 1

[Mike Connor [:mconnor]]

Works for me using Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7b)
Gecko/20040401 Firefox/0.8.0+

Please try installing into a new directory and creating a new profile, using the
firefox -p switch, and report your results here

also, this isn't a security-sensitive bug, that flag is really for "exploits" etc

Comment 2

[Mike Hoye]

Results for me are identical after creating a new profile.

Go to Options -> advanced -> manage certificates. Select "authorities" tab, then
the first item on the list, "ABA ECOM Root CA". Select "delete", click OK. The
bug will be off the list. Click OK in the cert manager window, then open it up
again - ABA ECOM will be back at the first spot on the list. This is true for
any/all deleted authority certs.

This is true for both the debian-packaged Firefox and my home-compiled one.

Before & after pics are:

http://off.net/~mhoye/moz/certs-removed.png (after I've deleted all the
authorities from my list) and http://off.net/~mhoye/moz/certs-reappear.png
(which pretty much looks like it does when you start, but I swear that's what
happens.)

Sorry about misapplying the security tag.

Comment 3

[Heikki Toivonen (remove -bugzilla when emailing directly)]

Removing security-flag.

Comment 4

[Josh Birnbaum]

*** This bug has been marked as a duplicate of 222139 ***