520830 - Firefox is trying to add security exception instead failing to establish connection

Status: NEW

(NSS :: Libraries, defect, P2)

Description

[Alexander L. Slovesnik]

STR:
Open https://cert.taxcom.ru/ui/ (AFAIK this site uses GOST Cipher Suites for TLS ( http://en.wikipedia.org/wiki/GOST_%28block_cipher%29 ), not supported by Mozilla's NSS).

Expected result: 
Firefox should show helpful message with text like "Firefox doesn't support this kind of SSL encryption, sorry".

Actual result:
User is trying to add security exception, but failing. Pressing button "Confirm Security Exception" doesn't do anything and user stuck.


P.S. SeaMonkey 1.1.18 shows error "Could not establish an encrypted connection because certificate presented by cert.taxcom.ru is invalid or corrupted. Error code : -8102" on this page.

Comment 1

[Jo Hermans]

note: GOST support is requested in bug 518787

Comment 2

[Kai Engert (:KaiE:)]

In the above test case, NSS produces error code sec_error_inadequate_key_usage.

In bug 427081 it was decided that error code sec_error_inadequate_key_usage should be possible to override.

Now we get this error code in a scenario where we have an unsupported algor.

Bob, Nelson, do you think this scenario should produce a different error code?

Comment 3

[Nelson Bolyard (seldom reads bugmail)]

Yes, the problem with this cert is that the public key type is unknown.

Function CERT_CheckKeyUsage extracts the key from the cert and uses the 
type of the extracted key (e.g. RSA, DSA, EC, etc.) to decide if the key 
is consistent with the specified required key usage.  If the key type is 
unknown, it sets error SEC_ERROR_INADEQUATE_KEY_USAGE.  It would probably 
be much better if it returns an error code saying "unknown key type".
The closest error we have is "SEC_ERROR_BAD_KEY".

Likewise, when that function returns SECFailure, it callers also
sets SEC_ERROR_INADEQUATE_KEY_USAGE. see CERT_VerifyCert,
cert_VerifyCertChainOld, CERT_VerifyCertificate, lines 881, 1121, 1268 
and 1477.  These should all be fixed, IMO.

Comment 4

[Kai Engert (:KaiE:)]

Nelson, thanks for confirming and researching the places. It sounds like the patch is easy to do. Who wants to write the patch and test it?

Comment 5

[Nikolay Shopik]

That will be WFM when bug 608725 is landed I assume.

Comment 6

[BugBot [:suhaib / :marco/ :calixte]]

The bug assignee is inactive on Bugzilla, and this bug has priority 'P2'.
:beurdouche, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 7

[Marco Castelluccio [:marco]]

We have modified the bot to only consider P1 as high priority, so I'm cancelling the needinfo here.