462966 - PSM reports OCSP error for site with an expired cert

Status: RESOLVED DUPLICATE of bug 1045739

(Core :: Security: PSM, defect)

Description

[Nelson Bolyard (seldom reads bugmail)]

Using SM trunk nightly from 20081006, I visit 
https://www.cyberguard.com/download/white_paper/en_SSL.pdf
and get an error page complaining 

   The OCSP server has refused this request as unauthorized.
   (Error code: sec_error_ocsp_unauthorized_request)

The cert is actually EXPIRED.  The server is correctly telling us that 
it does not answer requests for expired certs.

We should not be attempting an OCSP check on an expired cert.  

But whether we do or not, the error page should tell us that the cert is expired.  That is the most important fact in this case.  

It should also let us look at the cert, even if it does not let us set
a security exception, but maybe present FF UI makes that difficult or 
impossible.

Comment 1

[Nelson Bolyard (seldom reads bugmail)]

Just to clarify, the central issue of this bug is that it reported an 
OCSP error when it should have reported that the cert was expired.

Other issues, such as whether it should even attempt an OCSP query and
whether it lets us look at the bad cert are secondary.  The key thing
is: when a cert is expired, that's what PSM should tell us about it.