683454 - Invalid handling of expired SSL certificate

Status: RESOLVED DUPLICATE of bug 659736

(Core :: Security: PSM, defect)

Description

[Kamil Rojewski]

Attachment: certificate validation error

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:6.0) Gecko/20100101 Firefox/6.0
Build ID: 20110812101623

Steps to reproduce:

After entering a site with invalid (expired) certificate, Firefox showed the warning page. On add exception dialog, the certificate was listed as valid, although Certificate Viewer correctly shows the certificate as expired. There seems to be an inconsistency in certificate validation that could possibly lead to accepting invalid certificates.


Actual results:

Firefox show the certificate is valid and invalid at the same time.


Expected results:

Firefox should show the certificate as expired on all occasions.

Comment 1

[Brandon Sterne (:bsterne)]

Not an exploit that needs to remain hidden.

Comment 2

[Carlos Izquierdo]

Bug confirmed for versions 5 and 6 on Debian Linux as well.

I also want to point out that this bug also affects functionality:

* Given a (for example, internal) website you trust the "Untrusted connection warning" gets displayed
* Trying to add an exception fails since the certificate is shown as valid on the "Add Security Exception" dialog and the "Confirm Security Exception" button is disabled
* There is no easy way to force the browser to enter the page anyway