288713 - moz 1.4.1 cannot decode certs made by NSS 3.10 Beta 1

Status: RESOLVED INVALID

(NSS :: Libraries, defect)

Description

[Nelson Bolyard (seldom reads bugmail)]

I am running a selfserv server using a cert chain built by all.sh for 
NSS 3.10 Beta.  When I visit this server with mozilla 1.8b (built several
weeks ago), it works fine.  When I visit it with mozilla 1.4.1 or 
Netscape 7.1, those browsers show error -8183, which is SEC_ERROR_BAD_DER.

Julien's testing shows that no version of NSS older than 3.9 can decode
these certs.  

So, the questions are:
a) are we building invalid certs now? or are we building valid certs that
older browsers simply cannot parse (due to a bug fixed in 3.9, perhaps)?

b) what characteristic of the new certs renders them unparsable by older
NSS versions?  Julien suspects it is the use of Generalized Time.  

This is potentially a P1 release stopper for Sun, since some customers 
use NSS (via certutil) to generate self-issued certs for their intranet
servers.

Comment 1

[Nelson Bolyard (seldom reads bugmail)]

Julien is diagnosing this at the moment. 
Leaving unconfirmed until we know the exact cause.

Comment 2

[Julien Pierre]

all.sh creates a CA cert 50 years in the future, in order to test the
GeneralizedTime encoding. Thus, any browser using NSS older than 3.9 will fail
to decode the CA cert generated by all.sh.

Comment 3

[Nelson Bolyard (seldom reads bugmail)]

Julien, thanks for resolving this bug.  I'm very glad it's not a regression.

Comment 4

[Nelson Bolyard (seldom reads bugmail)]

See bug 288788 for a real SSL bug related to this one.