482996 - Investigate revocation behavior on www.softballoutlet.com

Status: RESOLVED DUPLICATE of bug 479029

(NSS :: Libraries, defect)

Description

[Kai Engert [:KaiE:]]

According to bug 477244 comment 73 the site https://www.softballoutlet.com/ is supposed to trigger EV UI.

I confirm it doesn't get EV UI anywhere, neither FF 3.0 (NSS 3.12.2), nor FF 3.1 (NSS 3.12.2) pre, nor FF experimental trunk (NSS 3.12.3)

I configured "strict OCSP" meaning, if there's a problem with OCSP, I want the server cert treated as invalid.

With both FF 3.0 and FF 3.1 pre, this gives me an error page, Error code: sec_error_ocsp_invalid_signing_cert which suggests a problem on the OCSP server side.

It has been claimed that this failure on https://www.softballoutlet.com/ is caused by bug 479029, which has been fixed in NSS 3.12.3. And indeed, with FF experimental trunk this error code is not produced.

But why do I still not get EV UI with Firefox trunk?

Comment 1

[Kai Engert [:KaiE:]]

Please search bug 477244 for comments that mention softballoutlet for additional information.

Comment 2

[Kai Engert [:KaiE:]]

In my earlier testing today I stated I did not get EV UI for this site using a Firefox 3.1 beta build, nor using a stable Firefox 3.0.x build.

I repeated my testing and now I get EV UI for both of them!!!!

I cleaned up some intermediate certs in my profile.
I suspect a bug either in NSS processing of multiple alternative intermediates, or maybe the need to fix something in the intermediates issued?

Comment 3

[Kai Engert [:KaiE:]]

Ok, I should have read bug 479029 more carefully before performing my tests.
I see it depends on the certs installed in one's profile.

This can probably be resolved as a dupe of bug 479029.

Comment 4

[Nelson Bolyard (seldom reads bugmail)]

Marking Dup per Kai's suggestion.

Comment 5

[Rob Stradling]

In reply to comment #2:
> I suspect...maybe the need to fix something in the intermediates issued?

Kai, the "Network Solutions EV SSL CA" certificate (which issued the EV certificate for https://www.softballoutlet.com) does not contain AIA->OCSP.
So, to get the EV UI for this site with NSS HEAD, I think you'd need to do at least one of the following:
  1. Apply your "Patch to relax requirements on intermediate certs" from Bug #477244.
  2. Apply my "Patch NSS to use default OCSP Responders for EV certificate chains from Comodo and Network Solutions" from Bug #477244.
  3. Manually import the CRL referenced in the "Network Solutions EV SSL CA" Certificate's CDP extension.