417182 - automatic update of CRLs not working

Status: RESOLVED DUPLICATE of bug 371522

(Core :: Security: PSM, defect)

Description

[Philip Poxon]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8.1.12) Gecko/20080201 Firefox/2.0.0.12
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8.1.12) Gecko/20080201 Firefox/2.0.0.12

I have 3 revocation lists that are set to automatic update and the Manage CRL dialog states all three lists are set to update one day before they expire. During the last three months I have had problems on the day the lists are supposed to update. They are not automatically updating.  I can manually update each list individually, and everything works OK until the next day they are to update. The lists currently show next update due 2 weeks from the last time I manually updated.  The dialog box says that all three lists are set for automatic update and automatic update status is "OK", but they do not update automatically.

Reproducible: Always

Steps to Reproduce:
1.open Tools, options,Advanced, Encryption, Revocation lists 
2.Check date currently showing for lists. if past date for update, list not updated.
3.must manually update lists to make current



I came across this problem when I started to have problems with version 2.0.0.11
I started to have problems accessing secure sites. The solution suggested was to turn off oscp option to verify certificates.  That is when I checked all the certificates in the current database and found several of the certificates had expired. I also looked at the certificate revocation lists and then found that the lists were not being updated automatically. I have kept them up to date by manually updating the lists each time the browser failed to update.

Comment 1

[Jan Tomasek]

I'm having similar problem. I want to have my CRL updated every 1 day. But Firefox/Thunderbird never do it. 

I tested and reproduced this problem in:
   Thunderbird version 2.0.0.12 (20080213)
   Iceweasel/2.0.0.12 (Debian-2.0.0.12-1)
   Firefox 3.0 RC1 and RC2

I would realy like to have this feature working. Especialy after so many certificates were revoked after weak random number generator discovery in Debian.