338424 - Importing expired certificates fails silently

Status: RESOLVED DUPLICATE of bug 310446

(Thunderbird :: Security, defect)

Description

[Chandrasekar Kannan]

when trying to import another users email encryption certificate that is expired, thunderbird fails silently to import. 

there's no error message indicating that an error has occurred.

Comment 1

[Bob Lord]

This also happens when the cert chain is not trusted.  TB will not let you import another user's S/MIME cert until the chain above it validates.  There should be an error message to this affect.

Of course, this then brings up another question: why not let me import the certificate without the chain being trusted?  It's sometimes simpler to build the chain from the bottom up.

Comment 2

[Bob Lord]

-> Kai

Comment 3

[Kai Engert (:KaiE:)]

There are 3 separate issues here.

First, when reading a signed message, where the signature cert has expired.
IMHO it is correct not to import expired certs.
IMHO we should not give erre messages.

Second, when the user explicitly tries to import a cert from a file.
I agree, in this case, when the cert is being ignore, feedback should be given to the user.
This is already being tracked by bug 310446.

Third, you are talking about not-yet-expired, but untrusted certs.
You are proposing an enhancement to interactively import such a cert.
I absolute agree it would be helpful.
This has been proposed 3 years ago already in bug 209182.
We just need to find the time to eventually do it.




*** This bug has been marked as a duplicate of 310446 ***