290655 - Required to OK each new security certificate

Status: RESOLVED INVALID

(Firefox :: Security, defect)

Description

[Mark]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.6) Gecko/20050317 Firefox/1.0.2
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.6) Gecko/20050317 Firefox/1.0.2

I am required to "OK" each new security certificate.  I have set the Options to
"Select Automatically" each new certificate but still have to do this manually.

Reproducible: Always

Comment 1

[Josh Birnbaum]

It's not clear to me what you're doing.  Can you give steps to reproduce?

Comment 2

[Daniel Veditz [:dveditz]]

The "select automatically/ask every time" option applies to any certificates
*you* have obtained to sign forms before submitting them to the server. This is
extremely rare on the public internet, very few individuals have personal PKI certs.

What you are no doubt being asked to OK are web server certs that could not be
validated. There is absolutely no way to make this automatic, the only safe
automatic default would be to reject these unverifiable certs and disallow
connection to the website in question. As you can tell from the number of such
certs you encounter that would not be the best option.

Comment 3

[Mark]

(In reply to comment #2)
> The "select automatically/ask every time" option applies to any certificates
> *you* have obtained to sign forms before submitting them to the server. This is
> extremely rare on the public internet, very few individuals have personal PKI
certs.
> 
> What you are no doubt being asked to OK are web server certs that could not be
> validated. There is absolutely no way to make this automatic, the only safe
> automatic default would be to reject these unverifiable certs and disallow
> connection to the website in question. As you can tell from the number of such
> certs you encounter that would not be the best option.


I did not encounter so many requests using IE and it has only been recently that
I encountered this with Firefox -- I don't recall having to approve so many when
I used the beta product nor for the first few months of 1.0.  Is there any
reason why this would have change?

Mark

Comment 4

[Daniel Veditz [:dveditz]]

Specific web sites where you get this would certainly help a lot.