618012 - Intermediate CA certificates missing in Firefox 3.6.12 on Windows 2000

Status: RESOLVED INVALID

(NSS :: Libraries, defect)

Description

[Matthew Middleton (:zzxc)]

A user on SUMO reported that https://customersupport.dishnetwork.com returns a certificate error ("The certificate is not trusted because the issuer certificate is unknown") in Firefox 3.6.12 on Windows 2000, even after deleting cert8.db and installing to an empty folder.  Upon inspecting the certificate authorities in Firefox's advanced preferences, he realized that only Verisign's built-in root certificates were listed under Authorities.  All intermediate certificates (including Verisign Class 3 Secure Server CA) were missing.

I don't have a Windows 2000 VM available for testing this, so I don't know if this is a regression or a system problem affecting just this user.  I have the user's contact information, so I can request more details from the original reporter as needed.

Comment 1

[Nelson Bolyard (seldom reads bugmail)]

This is a server misconfiguraton.  servers are required to send the whole 
certificate chain, with all necessary intermediate CA certificates, not 
just their own cert certificate.  It's always been this way.

Firefox will store validated intermediate CA certificates in cert8.db,
but your user cleverly blew that away so now he's out of luck there.

Comment 2

[Kai Engert [:KaiE:]]

By deleting "only" cert8.db the user created a broken configuration.

If the user really wanted to clean up the NSS storage, loosing all old certificate and trust settings, but keeping the rest of the profile, the user should quite all mozilla/firefox software, delete "key*.db" and "cert*.db" and "secmod.db" and "pkcs11.txt" from the profile directory, and then try again.

This will not fix the problem with a server sending an incomplete chain. If the server doesn't show the path from its own server cert to a trust root, then it's the server's fault.

Comment 3

[Bob]

Per I.E. the complete cerificate chain appears to be present with valid certificate data.


VeriSign Class 3 Public primary CA
  VeriSign Class 3 Secure Server CA
    customersupport.dishnetwork.com

Comment 4

[Bob]

Is this intermediate certificate data cached or stored in I.E., thus making it work in I.E. and making it old/stale data?

Comment 5

[Kai Engert [:KaiE:]]

I don't know about IE, but it might be possible that it is caching intermediates.

IE also has a feature to dynamically fetch intermediates from the web, if there's information contained in the certs that points to the intermediates. It's not yet clear whether Firefox will add such a feature.

Also, Firefox caches intermediates over time.
If a site sends Firefox a valid intermediate, we'll cache it.
If you visit another site later, which requires the same intermediate, and is incorrectly configured, we can make it work automatically by automatically having the cert available, already.

(This is what could cause confusion.)

Comment 6

[Bob]

Is there any firefox logs that show the intermediate certificate is not present other than the Page info web site identity? 

Web site:  customersupport.dishnetwork.com
Owner:     This web site does not supply ownership information.
Verified:  Not specified


Note: 

1. The above listed https web site worked until about 3 weeks ago. Somewhat strange that dishnetwork would change which certificates are sent.

2. Matthew(Mozilla support chat) was able to successfully connect to the https://customersupport.dishnetwork.com without the error. If they were not sending intermediate certificates how did he connect without an error?

He did have a VeriSign Class 3 Secure Sever CA Software Security Device under the "Advanced - View Certificates" tab whereas mine does not.  How did he get this intermediate certificate in the certificate store?

I will attempt to pursue this issue with dishnetwork, once I have enough technical data to fel confident that it is truly their problem.

Thanks for the info.

Comment 7

[Bob]

Ok, I think I have the answer #2 above. Based on some looking around, Matthew must have visited a website (other than dishnetwork) that sent the intermediate VeriSign Class 3 Secure Server CA certificate, thus it was now in the cert8.db file (Certificate Manager).

Is there a way to get the intermediate certificate from VeriSign? Dealing with Dishnetwork is a real pain, and they probably will not fix the problem based on a customer complaint.

Comment 8

[Bob]

Ok, I think I have the answer #2 above. Based on some looking around, Matthew must have visited a website (other than dishnetwork) that sent the intermediate VeriSign Class 3 Secure Server CA certificate, thus it was now in the cert8.db file (Certificate Manager).

Is there a way to get the intermediate certificate from VeriSign? Dealing with Dishnetwork is a real pain, and they probably will not fix the problem based on a customer complaint.

Comment 9

[Bob]

Work around successful.  I.E. was able to successfully retrieve the intermediate certificate in the chain. I was then able to successfully save the certificate to a file as a Base-64 encoded X.509(.CER) file and then import it into Firefox's certificate store via the certificate manager. 

Not sure if I of the energy to convince Dishnetwork to add the intermediate certificate data.

Thank for the info and listening. This call can be closed.