266013 - Needs to correctly support Go Daddy / Starfield SSL

Status: RESOLVED INVALID

(NSS :: Libraries, defect)

Description

[Johnny Proton]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.3) Gecko/20040922 Epiphany/1.2.7
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.3) Gecko/20040922 Epiphany/1.2.7

Go Daddy is selling Starfield SSL certificates, and they are quite popular. 
However, Mozilla-based browsers do not correctly identify the certificate.  This
causes a lot of "untrusted" errors on sites which use these certificates so
please build support in for them.

Reproducible: Always
Steps to Reproduce:
1.
2.
3.

Comment 1

[Wan-Teh Chang]

Do you know what we need to do to support these
SSL certificates?

Comment 2

[Johnny Proton]

I'm not an expert on this but I think you need to include the "root certificate"
or something.  If you want to examine one, go to
https://www.nadonauniversity.org/ and you can replicate the error.

Also http://starfieldtech.com/ and talk to support.  Sometimes they know,
sometimes they don't but if you have them escalate the call and tell them you're
a Mozilla developer trying to build in compatibility I'm sure they will get you
to a guy who knows.

Basically, the name of the company changed when Starfield bought the SSL
business and now the certs don't verify on Mozilla browsers, but they do on IE.
 Go Daddy is selling these things super-cheap so people are buying them up and
it looks bad for Firefox/Mozilla not to work.

Comment 3

[Nelson Bolyard (seldom reads bugmail)]

How about a reproducible test case for this bug report?

Comment 4

[Robert Relyea]

My guess is this is a server configuration problem. I am currently using a
go-daddy/Starfield SSL certificate and it's working correctly with all forms of
netscape and mozilla browers I have testest (netscape 7, Firefox, mozilla 1.x).

The important magic is the server must include the Starfield intermediate
certificate in it's server chain. Starfield chains to Valicert, which is trusted
in all forms of Netscape mozilla browsers since netscape communicator 4.0.

If you are using a netscape Web server (NES), you simply need to import the
Starfield intermediate CA into your CA database. NES will automatically include
it in the chain.

If you are using apache add the following line to your ssl.conf (or httpd.conf)
file:

SSLCertificateChainFile /etc/httpd/conf/ssl.cert/ca.crt

Then copy the godaddy cert (in .pem format) to /etc/httpd/conf/ssl.cert/ca.crt.

bob

Comment 5

[Wan-Teh Chang]

I confirmed that this is a server configuration
problem with https://www.nadonauniversity.org/.

Marked the bug invalid.

Comment 6

[Josh Birnbaum]

*** Bug 256648 has been marked as a duplicate of this bug. ***

Comment 7

[Nelson Bolyard (seldom reads bugmail)]

*** Bug 268849 has been marked as a duplicate of this bug. ***

Comment 8

[Josh Birnbaum]

*** Bug 314200 has been marked as a duplicate of this bug. ***