685459 - 3.12 vs. 3.13 - with 3.13 the knockout certs appear in Cert Manager's server tab

Status: RESOLVED INVALID

(NSS :: Libraries, defect, P5)

Description

[Kai Engert [:KaiE:]]

- Using a nightly Firefox build that has been upgraded to NSS 3.13 beta
- Using Cert Manager at the knockout certs we added for DigiNotar.

expected:
the knockout CA certs should be listed in the "Authorities" tab

actual behaviour:
the knockout CA certs are listed in the "Servers" tab

I don't know yet if this is an NSS bug or PSM bug.

Comment 1

[Wan-Teh Chang]

Bob: please review my findings below.

Kai: I tracked down this bug.  This bug is caused by two things:

1. The trust flags for the distrusted CA certs in certdata.txt
changed between NSS 3.12 and NSS 3.13.  Bob explained the
difference in bug 642503 comment 20:

  The  nssTrustLevel mapping to and from PKCS #11 has changed as as follows

  Formerly:
  CKT_NSS_UNTRUSTED (now CKT_NSS_MUST_VERIFY_TRUST) -> nssTrustLevel_Untrusted
  ...

  Now:
  CKT_NSS_NOT_TRUSTED (was CKT_NSS_VALID) -> nssTrustLevel_Untrusted
  ...

  The nssTrustLevel mapping to and from certdb trust have changed a follows:

  Formerly:
  nssTrustLevel_Untrusted -> 0 (no bits set)
  ...

  Now:
  ...
  nssTrustLevel_Untrusted -> CERTDB_VALID_PEER (now CERTDB_TERMINAL_RECORD)

  ...

  Semantic differences

  ...

  **** certdata.txt ****
  The MD5 Collisions forged Rogue CA:
  Was CKT_NETSCAPE_UNTRUSTED which now mapps to CKT_NSS_MUST_VERIFY_TRUST
  was changed to CKT_NSS_NOT_TRUSTED (formerly CKT_NSS_VALID).

  This isn't a major semantic change. A different value will be passed
  out of PKCS #11, and different bits will be set on the cert at the
  user level (p,p,p rather then ,, ). ...

Note that the trust attributes changed from ,, to p,p,p.

2. PSM's getCertType function uses an inaccurate test for
server certs:
http://mxr.mozilla.org/mozilla-central/ident?i=getCertType

2245   if (trust.HasAnyCA())
2246     return nsIX509Cert::CA_CERT;
2247   if (trust.HasPeer(PR_TRUE, PR_FALSE, PR_FALSE))
2248     return nsIX509Cert::SERVER_CERT;
2249   if (trust.HasPeer(PR_FALSE, PR_TRUE, PR_FALSE) && cert->emailAddr)
2250     return nsIX509Cert::EMAIL_CERT;
2251   if (CERT_IsCACert(cert,NULL))
2252     return nsIX509Cert::CA_CERT;

The new trust attributes p,p,p cause the server cert test
trust.HasPeer(PR_TRUE, PR_FALSE, PR_FALSE) to return true.

This can be fixed by performing the CERT_IsCACert(cert,NULL)
test before the server cert test.