414556 - Chain validated also with missing intermediate CRL (PKITS test 4.4.1)

Status: RESOLVED INACTIVE

(NSS :: Libraries, defect, P5)

Description

[Slavomir Katuscak]

PKITS test 4.4.1 (Missing CRL) fails for NSS.

Certification path: root certificate + CRL, intermediate certificate (without CRL) and end certificate. End certificate is validated although intermediate CRL is missing.

Comment 1

[Nelson Bolyard (seldom reads bugmail)]

For the current ("old") NSS Cert library, this behavior is working as intended.
So, this is not really a bug in NSS 3.11.x, but ...

The new function CERT_PKIXVerifyCert, in NSS 3.12, is defined to allow the 
caller to require conformance with NIST's revocation policy.  I don't know
if that's implemented yet, but when it is, we should check that this test 
passes when CERT_PKIXVerifyCert is called with NIST revocation policy specified. 

Comment 2

[Julien Pierre]

This cannot be resolved until vfychain supports using CERT_PKIXVerifyCert with the NIST CRL policy. See bug 412468 .

Comment 3

[Nelson Bolyard (seldom reads bugmail)]

Unsetting target milestone in unresolved bugs whose targets have passed.

Comment 4

[Kai Engert (:KaiE:)]

Bugs that are currently assigned to Julien => assigning to nobody.
Search for 20100628-kaie-jp