Closed Bug 405004 Opened 18 years ago Closed 18 years ago

FF3: sec_error_reused_issuer_and_serial when using HTTPS

Categories

(Core :: Security: PSM, defect)

Product:
Core
Component:
Security: PSM
Platform:
x86
Windows XP
Type:
defect
Priority:
Not set
Severity:
major

Tracking

()

Status:
RESOLVED INVALID

People

(Reporter: cpuidle, Assigned: KaiE)

Details

My company uses an HTTPS proxy that inspects the SSL traffic. This appears to be similar to the classic "man in the middle" attack but in this case is justified. Unfortunately, this renders FF3 useless, as I'm receiving "sec_error_reused_issuer_and_serial" error pages. Is there a security setting to disable this behaviour?
I don't believe the FF3 changes had anything to do with the rejection of duplicate certs. What error dialog do your FF2 users get?
Assignee: nobody → kengert
Component: Security → Security: PSM
Product: Firefox → Core
QA Contact: firefox → psm
Mhhm. Doing these steps to reproduce: - open page in FF3- same error as described - open page in FF2- page opens, no error. Inspecting certificate shows that certificate has been signed by my company, not one of the standard certification authorities - open page in FF3- no more error So- I think the FF2 behaviour might be different and actually changes something in the certificate store?
I've verified that FF2 fails under the same circumstances, but with different error message (invalid certificate). Insofar the FF3 behaviour is better than FF2. Unfortunately, neither version is able to browse to the encrypted sites via company proxy. IE however is able to handle the situation- not sure how it handles the security checks differently?
Mozilla / NSS might do stricter checking of constraints than other software. This bug is invalid, if your environment indeed uses duplicate issuer+serial for different certs. This is the issue that you must fix.
Status: UNCONFIRMED → RESOLVED
Closed: 18 years ago
Resolution: --- → INVALID
You need to log in before you can comment on or make changes to this bug.