536406 - IPSCA SSL Cert not Accepted in Mozilla, Accepted in IE8

Status: RESOLVED DUPLICATE of bug 529286

(CA Program :: CA Certificate Root Program, task)

Description

[ndr]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6 (.NET CLR 3.5.30729)
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6 (.NET CLR 3.5.30729)

New IPSCA SSL Certificates are not being accepted. However, IE8 accepts them. Are there plans to update this CA soon? Many .edu domains are reporting this as a huge issue because IPSCA offers free certificates.

Reproducible: Always

Steps to Reproduce:
1. Access https://collab.ctrip.ufl.edu in Mozilla
2. Access https://collab.ctrip.ufl.edu in IE8
3. Compare the result
Actual Results:  
IE8 loads page, accepts certificate. Mozilla does not trust the certificate.

Expected Results:  
Mozilla should trust the certificate.

Comment 1

[Jeff Walden [:Waldo]]

Not security-sensitive, moving to a more accurate component...

Comment 2

[Eddy Nigg (StartCom)]

This has nothing to do with the certificate (you might have installed): Firefox can't find the server at collab.ctrip.ufl.edu.

;; Got SERVFAIL reply from xx.xxx.xx.xxx, trying next server
;; Got SERVFAIL reply from xxx.xx.xx.xxx, trying next server
;; connection timed out; no servers could be reached

Comment 3

[ndr]

Perhaps it's a DNS issue. Did you include https:// in the url? It is an SSL only site.

Comment 4

[Eddy Nigg (StartCom)]

It IS a DNS issue: http://www.ip4easy.com/lookup.php?name=collab.ctrip.ufl.edu&type=A

Comment 5

[ndr]

Thank you Eddy. I am following another thread related to IPSCA certs. I think this thread can be closed.

Comment 6

[Eddy Nigg (StartCom)]

OK - I would nevertheless like to understand the problem you experience because at the moment the certificate should work if it's correctly installed. Do you have an alternative URL?

Comment 7

[David E. Ross]

Is this a duplicate of bug #529286?  No, it doesn't state the exact same problem; but it seems this is a consequence of that earlier bug report.

Comment 8

[Eddy Nigg (StartCom)]

Yes, apparently new certificates are issued from a root which isn't in Mozilla - most likely the one from bug 529286. I believe we can mark this bug as resolved.