473811 - Intermittent "Server Certificate Expired" ('localhost') message when sending email (Thunderbird)

Status: RESOLVED INVALID

(Thunderbird :: Security, defect)

Description

[neilr8133]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.5) Gecko/2008120122 Firefox/3.0.5
Build Identifier: version 2.0.0.19 (20081209)

Within the last day or so (Thursday, 2009-01-15) when sending emails from thunderbird I have started to receive intermittent warnings about an expired security certficate for site 'localhost'.

(In both cases seen so far I was sending GPG-signed message, but I don't think that's the problem because GPG doesn't use this kind of certificate.)

I've attached a screenshot of the message and the top-level Certificate Viewer display.  I tried Googling the SHA1 and MD5 fingerprints, but got no results.


Reproducible: Sometimes

Steps to Reproduce:
1. Compose email.
2. Hit 'send'
2b. (Sometimes?) Ask to convert from HTML to plaintext; answer 'YES'
3. Sign with GPG (Probably not relevant..)
4. "Connecting to SMTP server" progress window appears
5. "Server Certificate Expired" window pops up

By 'canceling' and trying again it sometimes repeats, but eventually goes through.
Actual Results:  
"Server Certificate Expired" window appears (sometimes)

Expected Results:  
Mail goes through

On 2008-11-20 I updated Thunderbird to v2.0.0.19 from v2.0.0.18.  No upgrades or additions/removals to installed plugins are recorded before November 2008.

Comment 1

[neilr8133]

Attachment: Message that certificate for 'localhost' has expired

Comment 2

[neilr8133]

Attachment: Certificate Viewer screen for expired 'localhost' security certificate

Comment 3

[Magnus Melin [:mkmelin]]

Guess: the smtp server you're using has got wrongfully got set up to use a test certificate. 

An smtp log might be useful: https://wiki.mozilla.org/MailNews:Logging

Comment 4

[Ludovic Hirlimann [:Usul]]

Neil could you provide the logs Magnus ask for in comment 3 ?

Comment 5

[neilr8133]

I haven't seen the symptoms manifest since I filed the report, and I've been purging logs where nothing went wrong.

Additional info:
Based on fresh information[1][2] I'm going to say that it was my ISP and not Thunderbird: apparently this has happened a few times over the years, curiously always with the same MD5 and CN/O/U "issued-to" fields.  Originally I'd Googled and found a few reports of it happening in old Thunderbird builds, which is why I submitted the report.  (I don't understand why my ISP always uses the *same* dummy certificate, but that's their problem, not yours.  :-)

(I'd close the ticket myself, but I don't know whether to mark it "INVALID" or "FIXED" since it was an external problem..)


[1] http://www.dslreports.com/forum/r21749053-Email-Comcast-Mail-servers-Compromised

[2] http://www.merit.edu/mail.archives/nanog/msg14355.html

Comment 6

[Ludovic Hirlimann [:Usul]]

(In reply to comment #5)

> (I'd close the ticket myself, but I don't know whether to mark it "INVALID" or
> "FIXED" since it was an external problem..)

FIXED is when a patch as been submited and applied. WORKS FOR ME - when it works. INVALID - when the issue is not related to the product. Hence closing INVALID.