286410 - www.idea.pl certificate can't be verified.

Status: RESOLVED INVALID

(Core :: Security: PSM, defect)

Description

[Lukasz Stelmach]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.5) Gecko/20041221
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.5) Gecko/20041221

It seems like the proper root certificates are not installed by default.

Reproducible: Always

Steps to Reproduce:
1. Run Mozilla.
2. Opent the specified URL.

Actual Results:  
The warning Mozilla beeing unable to verify site's identity appears and the
question (accept/accept for the session/reject) is asked.

Expected Results:  
The warning does not appear.

This also happens with Firefox 1.0.1

Comment 1

[Lukasz Stelmach]

The bug is quite wierd. Whe I launch Mozilla and try to enter the idea.pl site
(see URL) I get a wrning. So i refuse to accepth the certificate and wish not to
connect to this server any more (the third option). Next, when i connect to
https://www.thawte.com, which has got a certificate issued by the same authority
everything is clear. Later when I try to enter idea again (I refused to do it
once) the browser loads the page without a warning of any kind and says the
certificat is 100% OK.

In short:
1. Launch Mozilla
2. https://www.idea.pl/portal/map/map/register, WARNING
3. https://www.thawte.com/, OK
4. https://www.idea.pl/portal/map/map/register, OK

If i ommit step 2 everything else is the same.

Comment 2

[Frank Wein [:mcsmurf]]

If you look at the Cerficate Authority tree of this certificate (before visiting
thawte.com), you see that only www.idea.pl is listed there. Maybe the
certificate is a bit buggy (or NSS is ;)?

Comment 3

[Frank Wein [:mcsmurf]]

PSM i think, might be NSS so

Comment 4

[Frank Wein [:mcsmurf]]

NSS devs/QA: Maybe you could take a look at this if this is a PSM bug or a NSS
bug? I'm not sure about that. Bug also occours with current Mozilla trunk.

Comment 5

[simon annear]

can confirm this on both linux (1.8b) and windows (1.8a6)

A slightly different testcase

launch moz
1. https://www.thawte.com/, OK
2. https://www.idea.pl/portal/map/map/register, OK

shutdown and then relaunch moz
1. https://www.idea.pl/portal/map/map/register, WARNING

Comment 6

[Wan-Teh Chang]

This is not a PSM or NSS bug.  This is a misconfigured
SSL server.  The server needs to send the cert chain,
including the intermediate CA cert, to the clients.
Right now the server is sending just the leaf cert.

Please ask the server's administrator to correct this.

See also bug 100426 and bug 141612.

Comment 7

[Lukasz Stelmach]

I've just sent a note to their webmaster.