343224 - Cert viewer displays nonsense with OCSP enabled

Status: RESOLVED WORKSFORME

(Core :: Security: PSM, defect)

Description

[Kai Engert [:KaiE:]]

Cert viewer displays nonsense with OCSP enabled

For example, I have a revoked cert, but cert viewer displays "verified for email signing".

This is due to nsUsageArrayHelper::GetUsagesArray requesting CERT_VerifyCertificateNow with many usages at the same time. However, as soon as certificateUsageStatusResponder is contained in the list of requested usages, CERT_VerifyCertificateNow will skip OCSP checking!

This probably makes it necessary that we change the PSM implementation to do several verification calls.

As an initial attempt I removed this usage and tried again.

With this change, cert viewer behaves a little bit better, but it now says "could not verify for unknown reasons".

We should do better. 

This unclear message is shown, because CERT_VerifyCertificateNow, when called with multiple usages, returned SEC_ERROR_INADEQUATE_CERT_TYPE.

For testing I temporarily changed the code to request verification for email-signing only, and that gave me the correct "revoked" message at the UI level.

I conclude some PSM code needs to be rewritten to produce reasonable results.

Comment 1

[Kai Engert [:KaiE:]]

In addition, when a cert is revoked, we should no longer say "expires: original date".

We should either leave out this information, or replace it with the revocation date?

Comment 2

[Bob Lord]

It's worth having the expiration date as well as the revocation date.  We just need to figure out how to organize the layout.

Comment 3

[Kai Engert [:KaiE:]]

reassign bug owner.
mass-update-kaie-20120918

Comment 4

[Dana Keeler (she/her) [:keeler]]

The current certificate verifier does revocation checking - this shouldn't be an issue anymore.