351873 - OCSP checking not happening when viewing certificates.

Status: RESOLVED DUPLICATE of bug 351897

(Core :: Security: PSM, defect, P1)

Description

[Chandrasekar Kannan]

I have a client cert which has an AIA extension that points to an OCSP server.
I have imported that certificate onto firefox.
I have also imported and trusted the CA that issued this certificate.

On windows, for example, when using firefox 2.0b2, I goto,

Tools->options->Advanced->Encryption->Verification

select

Use OCSP to validate only certificates that specify an OCSP URL

then, I close firefox. relaunch it. I goto,


Tools->options->Advanced->Encryption->View Certificates.

If I select the certificate and Click 'View', OCSP request is not 
sent to the OCSP server.

But the UI still says 'verified'.

Comment 1

[Kai Engert [:KaiE:]]

See bug 149834 for a description of the issue.

This bug happens whenever the user uses a "view cert" button in the application.

When OCSP is enabled, this will result in OCSP being ignored and a false positive verification result can be displayed to the user.

Comment 2

[Kai Engert [:KaiE:]]

Attachment: Patch v1

This patch fixes the issue for me.

As described in "bug 149834 comment 23", NSS does not call OCSP when asked to verify a cert for usage "status responder".

This patch uses two separate calls, so OCSP will be checked for all usages except the responder usage.

Comment 3

[Mike Connor [:mconnor]]

Not going to block for something we don't enable by default anywhere, but we will likely take a well-tested and reviewed patch before freeze.

Comment 4

[Julien Pierre]

Comment on attachment 237407 [details] [diff] [review]
Patch v1

Kai,

I think this is better fixed in NSS than in PSM.

CERT_VerifyCertificateNow was designed to be functionally equivalent to a series of CERT_VerifyCertNow calls. So, it should do one OCSP check. It should only skip the OCSP check if the certificateUsageStatusResponder is the only usage requested.

Comment 5

[Kai Engert [:KaiE:]]

Patch fixed with check in to bug 351897.


*** This bug has been marked as a duplicate of 351897 ***