737389 - can't access https://db.debian.org

Status: RESOLVED INVALID

(NSS :: Libraries, defect, P5)

Description

[a_geek]

Trying to access https://db.debian.org leaves me with a page that offers to "Get me out of here". I can also see the "Technical Details", but every attempt to add an exception failed (also via Preferences -> Advanced). Net result: I cannot access the page.

The error message displayed by Firefox is:
---- cut
db.debian.org uses an invalid security certificate.

The certificate is not trusted because the issuer certificate is not trusted.

(Error code: sec_error_untrusted_issuer)
---- cut

The button to add an exception has vanished since the last update, and it doesn't work anymore, anyway. Switching validation on and off in the Preferences dialogue didn't have any effect.

Comment 1

[Cork]

Clicking "I Understand the Risks" > "Add Exception..." > "Confirm Security Exception" WFM on:
Mozilla/5.0 (X11; Linux x86_64; rv:14.0) Gecko/20120319 Firefox/14.0a1
Mozilla/5.0 (X11; Linux x86_64; rv:11.0) Gecko/20100101 Firefox/11.0
Mozilla/5.0 (X11; Linux x86_64; rv:12.0) Gecko/20100101 Firefox/12.0

Comment 2

[Matthias Versen [:Matti]]

Please try it again in the firefox safemode:
http://support.mozilla.org/en-US/kb/Safe+Mode

Please post your used distribution and if you use a Firefox build from that distribution.

Comment 3

[a_geek]

I use the FF 11.0 as distributed by Mozilla.org, installed via the Update mechanism (started out as 4.0 or similar), on an up-to-date Debian Squeeze/i386.

Trying Safe Mode didn't help anything, but creating a full new profile did. Looks like FF messed up my profile, again. Any idea about how to fix it, please?

Comment 4

[Matthias Versen [:Matti]]

Can you clear the disk cache in your old profile ?

Comment 5

[Wayne Mery (:wsmwk)]

(In reply to Matthias Versen (Matti) from comment #4)
> Can you clear the disk cache in your old profile ?

Comment 6

[Zack Weinberg (:zwol)]

For me, with a cleared disk cache, https://db.debian.org/ and https://lists.debian.org/ both show the "sec_error_untrusted_issuer" error. I am offered the option to override this for db.debian.org, but not for lists.debian.org.

Both sites' certificates chain to the same private CA:

$ openssl s_client -connect lists.debian.org:443 -showcerts
CONNECTED(00000003)
depth=2 C = US, ST = Indiana, L = Indianapolis, O = Software in the Public Interest, OU = hostmaster, CN = Certificate Authority, emailAddress = [e-mail]
verify error:num=19:self signed certificate in certificate chain
verify return:0
---
Certificate chain
 0 s:/O=Debian/CN=lists.debian.org/emailAddress=[e-mail]
   i:/O=Debian/CN=ca.debian.org/emailAddress=[e-mail]
-----BEGIN CERTIFICATE-----
MIIFPDCCAySgAwIBAgIBSTANBgkqhkiG9w0BAQUFADBRMQ8wDQYDVQQKEwZEZWJp
YW4xFjAUBgNVBAMTDWNhLmRlYmlhbi5vcmcxJjAkBgkqhkiG9w0BCQEWF2RlYmlh
bi1hZG1pbkBkZWJpYW4ub3JnMB4XDTEyMDMwODIwMTgwMFoXDTEzMDMwODIwMTgw
MFowVDEPMA0GA1UEChMGRGViaWFuMRkwFwYDVQQDExBsaXN0cy5kZWJpYW4ub3Jn
MSYwJAYJKoZIhvcNAQkBFhdkZWJpYW4tYWRtaW5AZGViaWFuLm9yZzCCASIwDQYJ
KoZIhvcNAQEBBQADggEPADCCAQoCggEBAK5jYVx8OAXmmqVFwDKiFDN2J8RufXZy
BGyzL960haXu058Kr6NgezNmDkCCBlCiCJ6yMJ6fIhuDrx39GzOvAtcHH9WGBO0O
YuQH9IFLUDCqi7/PD7WFW0yO01uHxhTDLTQc5bbqDsr6G2SD5W8MKjFvpnJeedug
efKQJ7UM+XatsqE/i++nW831JA1RRWYz5lwQ0BP8fEsUkj9Uw/suxegS/Stzx0XC
1Hsf2Rk54Ffpi6QJZXE25cPpVd3ir8GaDZEKPwW3h87zS5YPSfF+/hEafPdzPKXU
U57riFxdr186Q5UH/3oD5NI98ZnWltB95AcyMwqanaugsf9J6R/iKI8CAwEAAaOC
ARowggEWMAkGA1UdEwQCMAAwHQYDVR0OBBYEFBMMM7pYwshJq0k74uNoRATKT1O2
MIHpBgNVHSMEgeEwgd6AFKfPS/pfEsYjdC6eo5WQdYzMJnaWoYHCpIG/MIG8MQsw
CQYDVQQGEwJVUzEQMA4GA1UECBMHSW5kaWFuYTEVMBMGA1UEBxMMSW5kaWFuYXBv
bGlzMSgwJgYDVQQKEx9Tb2Z0d2FyZSBpbiB0aGUgUHVibGljIEludGVyZXN0MRMw
EQYDVQQLEwpob3N0bWFzdGVyMR4wHAYDVQQDExVDZXJ0aWZpY2F0ZSBBdXRob3Jp
dHkxJTAjBgkqhkiG9w0BCQEWFmhvc3RtYXN0ZXJAc3BpLWluYy5vcmeCAQMwDQYJ
KoZIhvcNAQEFBQADggIBAGQWEK+mmlbx0IhU1Xk0xncN3B3ry7uCkfu1r1ScMvcL
41cgmYqBOVKf//hyimUnF2nWd/hiocMBO83ZrhFDh/IuMW1LX2yYXDzwcfMPuU0l
4xDmNNamwPJ536+UFnCr3LaVDyuMYlPekv5AvuMJS3GSdWFggXPwBYlr2DcEkkdD
e1dwkFbeuHCWHBJFJD4iwRRWr9xxiketPiaUxdriAblTUFVXWdhIVLV5uAkYJPnE
0epxHflLBYgSK0lg5cRG+30AgqCwAFujBTO5xZVYdGeeZJ68VL+VY552vJv33vmp
4tFjx0rO96lJUQkNAToaQfnjty5BkzwlAGrOLOSvASXs7fp7adc5Ljub5xOcs8Fn
xAqkZ9cxdB0Yn90mTeRf5jAQPt28bYGAT5kFsDusqqanZnptuPssGIpTD8FBD73D
5MbNH2EFbJxF79qgkx76QpVXYKbzCBeDZvyGimd9AEWLwdm098uzKXLn6Q0l+/xz
nUnn8otwLTCGgNLrch0E0ARN7H9ykGh1Xer+CoB7r3I6ocwePx7a2f0yijZaoDXK
Qn+wu2dxoHp/hDnP2IMKTLJbcJzPB5k4VB4mxS9S/tMbZAhw3neFDfDXZ52Ca4Hu
E6RhGabZtKjy/uzsz0TnuPRRCr/o/5Rj6wr4XwLS5dw248iE53M4z3X5FHdf6eHz
-----END CERTIFICATE-----
 1 s:/O=Debian/CN=ca.debian.org/emailAddress=[e-mail]
   i:/C=US/ST=Indiana/L=Indianapolis/O=Software in the Public Interest/OU=hostmaster/CN=Certificate Authority/emailAddress=[e-mail]
-----BEGIN CERTIFICATE-----
MIIG4DCCBMigAwIBAgIBAzANBgkqhkiG9w0BAQUFADCBvDELMAkGA1UEBhMCVVMx
EDAOBgNVBAgTB0luZGlhbmExFTATBgNVBAcTDEluZGlhbmFwb2xpczEoMCYGA1UE
ChMfU29mdHdhcmUgaW4gdGhlIFB1YmxpYyBJbnRlcmVzdDETMBEGA1UECxMKaG9z
dG1hc3RlcjEeMBwGA1UEAxMVQ2VydGlmaWNhdGUgQXV0aG9yaXR5MSUwIwYJKoZI
hvcNAQkBFhZob3N0bWFzdGVyQHNwaS1pbmMub3JnMB4XDTA4MDUxMzA5MTMyMFoX
DTE4MDUxMDA5MTMyMFowUTEPMA0GA1UEChMGRGViaWFuMRYwFAYDVQQDEw1jYS5k
ZWJpYW4ub3JnMSYwJAYJKoZIhvcNAQkBFhdkZWJpYW4tYWRtaW5AZGViaWFuLm9y
ZzCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKo7PqWfRxraX7AYsBFi
O4TWASKLTTH711sRliHV16oRiKIpttSwq/GMQIYagtM4ccYyJYomPSSS2/2VjZIf
h/wAhxRSTmmA5eA8kIb+ZD013PjpKSVkxAhQPr44g2UGpOYwnAalCBhzHBpi48a+
FyAL6zjPBFOVJTVEnrLxZKan0ZNqscS99Sisk+D8cS/1twLBykAnTNo8gSwjjlg8
Fdzln14TggTMXBlTJU52vHSeSl0mt4XjDE9g+hG3Oxz9qMunz9wmDX0IoepsdNuO
GxDKaomYItuguoABraaVyNu77J4BzSOBmtNgKE3NOdgEssqJcIfp8AGOLchzdaVb
W1xinZqX3zoHpOcguJysdzkrCpv3CCmAGb/CON1nw/iQMWh29uF7SzsH4dySd/4H
/dDM+0wn6q7vU8WUaqrmUA9xqrpI3IOSxLyzlksNJeSbHsKi55IpGlGVYOPewgMB
LyAsXbXeHyW46Ja2ECSW+MOEU3li3gVtIQHbCEbk88fDNEwueH++HTZ8sX2O0rHJ
axkwg4P//o0CKTWkYnVJGbU2zkBPE4Yh+SgPITx4F+OvEA2JJ1JtrJPLX8PsbX3d
0a/dT2iUyoItVw52VOwQCaqY9BStEi0t8FWncBOVh/4kHB0Sb3TCW2HeABWZBQPI
bmaqVIN0G0n85lYVejrtMonxAgMBAAGjggFVMIIBUTAMBgNVHRMEBTADAQH/MB0G
A1UdDgQWBBSnz0v6XxLGI3QunqOVkHWMzCZ2ljCB8QYDVR0jBIHpMIHmgBQ0cdE4
1xU2g0dr1zdkQjuOjVKdq6GBwqSBvzCBvDELMAkGA1UEBhMCVVMxEDAOBgNVBAgT
B0luZGlhbmExFTATBgNVBAcTDEluZGlhbmFwb2xpczEoMCYGA1UEChMfU29mdHdh
cmUgaW4gdGhlIFB1YmxpYyBJbnRlcmVzdDETMBEGA1UECxMKaG9zdG1hc3RlcjEe
MBwGA1UEAxMVQ2VydGlmaWNhdGUgQXV0aG9yaXR5MSUwIwYJKoZIhvcNAQkBFhZo
b3N0bWFzdGVyQHNwaS1pbmMub3JnggkA6I62yfgqFCgwLgYJYIZIAYb4QgEEBCEW
H2h0dHA6Ly9jYS5kZWJpYW4ub3JnL2NhLWNybC5wZW0wDQYJKoZIhvcNAQEFBQAD
ggIBACysOecmX8iU2UI1bY1+1qGQkOu/+3XyIVaQADXyAGToHn8yVRUDmj7Ro3A2
ina7PPAZc6GEzuSsFddk6+ttgz36Oo/i1zvC7ANwDmbgJ9+IEnyOi42faWz6PIao
hSSsrl9oxoR6NUxnhY/dsAJzTtakXLOyz6HkQV10A7MlI7JGaBWuq3BD+2YI5f2G
TWkCfTqmbuKqm50nrhvTnwHBRNUO2/3vIAGIUQaJAMThFlryyC1Ouy2o/4UlTaS9
p0e92tzYaQ/Rh83HC3rgS0hXjyCEi8Ng7sQFb3s06MsRSiPGuoBki0kBJfFqBDl4
5b2Oe2mTW5ECB73bDorsIgeiHUupHfrDFv6BE9SytS/rOmjQWgLhvtbo3908rOOa
+HB/jONtYdNwoKdb4KPxjc0I+aBRdIGep+wlexgsAoxlU/p1X92NWBFO/2sIzxml
6ynNOe96aqLGI+uscdPI7fK2pd4OFJD6dOHs5g1wvIYRgMq/w2cvyZ04PNBMJElR
pUmOHYU4wvbKD7n3FfgEu5AR6fD/N7sLD7nm9qYxbu3C8Sy7Kx7my0oxXZbLTLLX
1AstvrI9n4aFTljdybSrzPVUwgI4Ac90qXE/k+jKxHfQbOIYZSy4YOyoa+iK6Ctt
QB7Nn/SKrSiD0TViBTkB2+yQsNv9vHLBphHDsOINDj/KcwRC
-----END CERTIFICATE-----
 2 s:/C=US/ST=Indiana/L=Indianapolis/O=Software in the Public Interest/OU=hostmaster/CN=Certificate Authority/emailAddress=[e-mail]
   i:/C=US/ST=Indiana/L=Indianapolis/O=Software in the Public Interest/OU=hostmaster/CN=Certificate Authority/emailAddress=[e-mail]
-----BEGIN CERTIFICATE-----
MIIIDjCCBfagAwIBAgIJAOiOtsn4KhQoMA0GCSqGSIb3DQEBBQUAMIG8MQswCQYD
VQQGEwJVUzEQMA4GA1UECBMHSW5kaWFuYTEVMBMGA1UEBxMMSW5kaWFuYXBvbGlz
MSgwJgYDVQQKEx9Tb2Z0d2FyZSBpbiB0aGUgUHVibGljIEludGVyZXN0MRMwEQYD
VQQLEwpob3N0bWFzdGVyMR4wHAYDVQQDExVDZXJ0aWZpY2F0ZSBBdXRob3JpdHkx
JTAjBgkqhkiG9w0BCQEWFmhvc3RtYXN0ZXJAc3BpLWluYy5vcmcwHhcNMDgwNTEz
MDgwNzU2WhcNMTgwNTExMDgwNzU2WjCBvDELMAkGA1UEBhMCVVMxEDAOBgNVBAgT
B0luZGlhbmExFTATBgNVBAcTDEluZGlhbmFwb2xpczEoMCYGA1UEChMfU29mdHdh
cmUgaW4gdGhlIFB1YmxpYyBJbnRlcmVzdDETMBEGA1UECxMKaG9zdG1hc3RlcjEe
MBwGA1UEAxMVQ2VydGlmaWNhdGUgQXV0aG9yaXR5MSUwIwYJKoZIhvcNAQkBFhZo
b3N0bWFzdGVyQHNwaS1pbmMub3JnMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIIC
CgKCAgEA3DbmR0LCxFF1KYdAw9iOIQbSGE7r7yC9kDyFEBOMKVuUY/b0LfEGQpG5
GcRCaQi/izZF6igFM0lIoCdDkzWKQdh4s/Dvs24t3dHLfer0dSbTPpA67tfnLAS1
fOH1fMVO73e9XKKTM5LOfYFIz2u1IiwIg/3T1c87Lf21SZBb9q1NE8re06adU1Fx
Y0b4ShZcmO4tbZoWoXaQ4mBDmdaJ1mwuepiyCwMs43pPx93jzONKao15Uvr0wa8u
jyoIyxspgpJyQ7zOiKmqp4pRQ1WFmjcDeJPI8L20QcgHQprLNZd6ioFl3h1UCAHx
ZFy3FxpRvB7DWYd2GBaY7r/2Z4GLBjXFS21ZGcfSxki+bhQog0oQnBv1b7ypjvVp
/rLBVcznFMn5WxRTUQfqzj3kTygfPGEJ1zPSbqdu1McTCW9rXRTunYkbpWry9vjQ
co7qch8vNGopCsUK7BxAhRL3pqXTT63AhYxMfHMgzFMY8bJYTAH1v+pk1Vw5xc5s
zFNaVrpBDyXfa1C2x4qgvQLCxTtVpbJkIoRRKFauMe5e+wsWTUYFkYBE7axt8Feo
+uthSKDLG7Mfjs3FIXcDhB78rKNDCGOM7fkn77SwXWfWT+3Qiz5dW8mRvZYChD3F
TbxCP3T9PF2sXEg2XocxLxhsxGjuoYvJWdAY4wCAs1QnLpnwFVMCAwEAAaOCAg8w
ggILMB0GA1UdDgQWBBQ0cdE41xU2g0dr1zdkQjuOjVKdqzCB8QYDVR0jBIHpMIHm
gBQ0cdE41xU2g0dr1zdkQjuOjVKdq6GBwqSBvzCBvDELMAkGA1UEBhMCVVMxEDAO
BgNVBAgTB0luZGlhbmExFTATBgNVBAcTDEluZGlhbmFwb2xpczEoMCYGA1UEChMf
U29mdHdhcmUgaW4gdGhlIFB1YmxpYyBJbnRlcmVzdDETMBEGA1UECxMKaG9zdG1h
c3RlcjEeMBwGA1UEAxMVQ2VydGlmaWNhdGUgQXV0aG9yaXR5MSUwIwYJKoZIhvcN
AQkBFhZob3N0bWFzdGVyQHNwaS1pbmMub3JnggkA6I62yfgqFCgwDwYDVR0TAQH/
BAUwAwEB/zARBglghkgBhvhCAQEEBAMCAAcwCQYDVR0SBAIwADAuBglghkgBhvhC
AQ0EIRYfU29mdHdhcmUgaW4gdGhlIFB1YmxpYyBJbnRlcmVzdDAwBglghkgBhvhC
AQQEIxYhaHR0cHM6Ly9jYS5zcGktaW5jLm9yZy9jYS1jcmwucGVtMDIGCWCGSAGG
+EIBAwQlFiNodHRwczovL2NhLnNwaS1pbmMub3JnL2NlcnQtY3JsLnBlbTAhBgNV
HREEGjAYgRZob3N0bWFzdGVyQHNwaS1pbmMub3JnMA4GA1UdDwEB/wQEAwIBBjAN
BgkqhkiG9w0BAQUFAAOCAgEAtM294LnqsgMrfjLp3nI/yUuCXp3ir1UJogxU6M8Y
PCggHam7AwIvUjki+RfPrWeQswN/2BXja367m1YBrzXU2rnHZxeb1NUON7MgQS4M
AcRb+WU+wmHo0vBqlXDDxm/VNaSsWXLhid+hoJ0kvSl56WEq2dMeyUakCHhBknIP
qxR17QnwovBc78MKYiC3wihmrkwvLo9FYyaW8O4x5otVm6o6+YI5HYg84gd1GuEP
sTC8cTLSOv76oYnzQyzWcsR5pxVIBcDYLXIC48s9Fmq6ybgREOJJhcyWR2AFJS7v
dVkz9UcZFu/abF8HyKZQth3LZjQl/GaD68W2MEH4RkRiqMEMVObqTFoo5q7Gt/5/
O5aoLu7HaD7dAD0prypjq1/uSSotxdz70cbT0ZdWUoa2lOvUYFG3/B6bzAKb1B+P
+UqPti4oOxfMxaYF49LTtcYDyeFIQpvLP+QX4P4NAZUJurgNceQJcHdC2E3hQqlg
g9cXiUPS1N2nGLar1CQlh7XU4vwuImm9rWgs/3K1mKoGnOcqarihk3bOsPN/nOHg
T7jYhkalMwIsJWE3KpLIrIF0aGOHM3a9BX9e1dUCbb2v/ypaqknsmHlHU5H2DjRa
yaXG67Ljxay2oHA1u8hRadDytaIybrw/oDc5fHE2pgXfDBLkFqfF1stjo5VwP+YE
o2A=
-----END CERTIFICATE-----
---
Server certificate
subject=/O=Debian/CN=lists.debian.org/emailAddress=[e-mail]
issuer=/O=Debian/CN=ca.debian.org/emailAddress=[e-mail]
---
No client certificate CA names sent
---
SSL handshake has read 6058 bytes and written 520 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: zlib compression
Expansion: zlib compression
SSL-Session:
    Protocol  : TLSv1
    Cipher    : DHE-RSA-AES256-SHA
    Session-ID: 2629D8BC905EAAB2F3FB5844EAD43CEA99A9EAC1DBAB08581FD7EE05138D98EF
    Session-ID-ctx: 
    Master-Key: 10E065A24C61148E63B3714F861ECD85F0D9AECED1CA15582E865A5F0B7CC66DB6C8DBEB6D10BBD687E928DD6C069B04
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket:
    0000 - 43 8d b3 dd 71 bd eb 58-e1 34 38 eb 71 1a d9 fc   C...q..X.48.q...
    0010 - 61 b2 38 63 4b 60 35 67-0b 90 75 45 ed c6 18 4c   a.8cK`5g..uE...L
    0020 - 97 7f b6 a8 4d 3a 33 96-38 1f 2b d7 0b 54 b6 15   ....M:3.8.+..T..
    0030 - c5 09 26 b8 67 5d 77 43-08 28 c4 d5 6a eb fe 1a   ..&.g]wC.(..j...
    0040 - d0 d0 67 34 f7 9e bc 52-6b a1 d1 e6 b9 0e 47 c7   ..g4...Rk.....G.
    0050 - d2 0f 2e b5 5f 3a a8 ea-31 c8 5f 7a 2d 4c ab f7   ...._:..1._z-L..
    0060 - ef 8e 02 28 6a ad 72 de-44 65 07 97 93 19 87 20   ...(j.r.De..... 
    0070 - 0e 10 b5 82 60 11 0e b2-da 49 ca 52 d8 ba a4 c9   ....`....I.R....
    0080 - 58 43 22 ac c6 b5 b8 02-09 f1 3b 34 93 ac f5 9f   XC".......;4....
    0090 - 0c 62 e6 fb e8 84 6e 41-ae 9e 8c 2f fc 90 02 25   .b....nA.../...%
    00a0 - e5 9a c8 85 bb 01 7f bc-a1 3e 3f 2e 9b 41 7e ab   .........>?..A~.
    00b0 - 24 53 75 a5 3a f0 5f c2-4b 52 c1 bc 37 17 61 1f   $Su.:._.KR..7.a.

    Compression: 1 (zlib compression)
    Start Time: 1341324299
    Timeout   : 300 (sec)
    Verify return code: 19 (self signed certificate in certificate chain)
---

and

$ openssl s_client -connect db.debian.org:443 -showcerts
CONNECTED(00000003)
depth=2 C = US, ST = Indiana, L = Indianapolis, O = Software in the Public Interest, OU = hostmaster, CN = Certificate Authority, emailAddress = [e-mail]
verify error:num=19:self signed certificate in certificate chain
verify return:0
---
Certificate chain
 0 s:/O=Debian/CN=db.debian.org/emailAddress=[e-mail]
   i:/O=Debian/CN=ca.debian.org/emailAddress=[e-mail]
-----BEGIN CERTIFICATE-----
MIIFOTCCAyGgAwIBAgIBSzANBgkqhkiG9w0BAQUFADBRMQ8wDQYDVQQKEwZEZWJp
YW4xFjAUBgNVBAMTDWNhLmRlYmlhbi5vcmcxJjAkBgkqhkiG9w0BCQEWF2RlYmlh
bi1hZG1pbkBkZWJpYW4ub3JnMB4XDTEyMDMxNjA2NTIyMloXDTEzMDMxNjA2NTIy
MlowUTEPMA0GA1UEChMGRGViaWFuMRYwFAYDVQQDEw1kYi5kZWJpYW4ub3JnMSYw
JAYJKoZIhvcNAQkBFhdkZWJpYW4tYWRtaW5AZGViaWFuLm9yZzCCASIwDQYJKoZI
hvcNAQEBBQADggEPADCCAQoCggEBAKjpcIQRBZmL3mJlbAdRNbFaPwVfcAtRQZqA
ba5Ctz3unxxoyBkDPOBFWe+tIi/G3AJoBGQwSarh/bcvRg2sKOZvAIA+l+ZpNQYS
GNTdcSx6UFfUXJ7Z3D4bE47rlv+EE571o8JNyGSg1aWvoYx10jkWgK7yg8uw8qsO
qY3gOeZWwiAIQPWKIgjELAL2BV/wIzuilDciYTGNncvdSsY3qGXMU1nUYEYCJyd1
H19LZVoI+O2JzDynas0dHpg/kxNvVXtayGrUITWBKOM99jXoQIv496hIm1bBv9cI
y4hLrOkYbdndIPzJ/JvnRgnH0HcnLEdoAXUBJZEQycpA8+wAJBECAwEAAaOCARow
ggEWMAkGA1UdEwQCMAAwHQYDVR0OBBYEFIb2KsN0b4HhDdl0qHPkrJ5SmKMgMIHp
BgNVHSMEgeEwgd6AFKfPS/pfEsYjdC6eo5WQdYzMJnaWoYHCpIG/MIG8MQswCQYD
VQQGEwJVUzEQMA4GA1UECBMHSW5kaWFuYTEVMBMGA1UEBxMMSW5kaWFuYXBvbGlz
MSgwJgYDVQQKEx9Tb2Z0d2FyZSBpbiB0aGUgUHVibGljIEludGVyZXN0MRMwEQYD
VQQLEwpob3N0bWFzdGVyMR4wHAYDVQQDExVDZXJ0aWZpY2F0ZSBBdXRob3JpdHkx
JTAjBgkqhkiG9w0BCQEWFmhvc3RtYXN0ZXJAc3BpLWluYy5vcmeCAQMwDQYJKoZI
hvcNAQEFBQADggIBABQubXeICPWiEVyPa+JnmCFH+cyGQluclGlHmbpiEJfbyMNz
Oh5F3bbExHkUDGGluWFAiJFvzAqcMT6NxopGS5ExlBf8RS70lXyZSSA9aZoeTfWV
bW6hlKcj2x3wCxIuBryU4/h81ym7sJFvkT8aegkq3V3QgnRNJa24MbvRKM3G88uk
9xrvXLhVW1YWRZ7wB7IFPi71YtfAHorJrcC+zG3eAdOVi/9ActKi/9Q7SDlXciAo
94BYXVmqKSISqjOxBwoOKlx4wlSwlidQNCgZ3DqK3gdJ3X+vuvL3XJyZI8Xzds5y
0j5ht8YjRpXQaE2/NsH/Xx6AYSIwxYH+iOV1kmG4aNQyTQksneqAB9rbd+jQdysK
CxhinG2TOtNz9CZk5GmqxXhhBpoENW6Q9AfpsicFMAAR73iUG4l7EJ1c0DLX6V43
omuCJaSmqZem20UfH6unAIP2RsZ3tNlfDURPocl32kb2hLzx1Qs2x97LBffdMCKC
xsjbeBGDx4JA9qmp24PSEmAlyUEjz/JQNiDvUaX+xicAMkuUeobn39uOk1itWlZT
xlXp2YSwxfZG/Q1HxpH3BjmgpHFKMm+zsLZmi+CTm6p/D9b9X19WGiJZKoO7zotd
4YyG1eD+ziFKiQstRo/q3gtfYlueepSleawz6hK5k7U4+C9wlMRg+XOzaFJ2
-----END CERTIFICATE-----
 1 s:/O=Debian/CN=ca.debian.org/emailAddress=[e-mail]
   i:/C=US/ST=Indiana/L=Indianapolis/O=Software in the Public Interest/OU=hostmaster/CN=Certificate Authority/emailAddress=[e-mail]
-----BEGIN CERTIFICATE-----
MIIG4DCCBMigAwIBAgIBAzANBgkqhkiG9w0BAQUFADCBvDELMAkGA1UEBhMCVVMx
EDAOBgNVBAgTB0luZGlhbmExFTATBgNVBAcTDEluZGlhbmFwb2xpczEoMCYGA1UE
ChMfU29mdHdhcmUgaW4gdGhlIFB1YmxpYyBJbnRlcmVzdDETMBEGA1UECxMKaG9z
dG1hc3RlcjEeMBwGA1UEAxMVQ2VydGlmaWNhdGUgQXV0aG9yaXR5MSUwIwYJKoZI
hvcNAQkBFhZob3N0bWFzdGVyQHNwaS1pbmMub3JnMB4XDTA4MDUxMzA5MTMyMFoX
DTE4MDUxMDA5MTMyMFowUTEPMA0GA1UEChMGRGViaWFuMRYwFAYDVQQDEw1jYS5k
ZWJpYW4ub3JnMSYwJAYJKoZIhvcNAQkBFhdkZWJpYW4tYWRtaW5AZGViaWFuLm9y
ZzCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKo7PqWfRxraX7AYsBFi
O4TWASKLTTH711sRliHV16oRiKIpttSwq/GMQIYagtM4ccYyJYomPSSS2/2VjZIf
h/wAhxRSTmmA5eA8kIb+ZD013PjpKSVkxAhQPr44g2UGpOYwnAalCBhzHBpi48a+
FyAL6zjPBFOVJTVEnrLxZKan0ZNqscS99Sisk+D8cS/1twLBykAnTNo8gSwjjlg8
Fdzln14TggTMXBlTJU52vHSeSl0mt4XjDE9g+hG3Oxz9qMunz9wmDX0IoepsdNuO
GxDKaomYItuguoABraaVyNu77J4BzSOBmtNgKE3NOdgEssqJcIfp8AGOLchzdaVb
W1xinZqX3zoHpOcguJysdzkrCpv3CCmAGb/CON1nw/iQMWh29uF7SzsH4dySd/4H
/dDM+0wn6q7vU8WUaqrmUA9xqrpI3IOSxLyzlksNJeSbHsKi55IpGlGVYOPewgMB
LyAsXbXeHyW46Ja2ECSW+MOEU3li3gVtIQHbCEbk88fDNEwueH++HTZ8sX2O0rHJ
axkwg4P//o0CKTWkYnVJGbU2zkBPE4Yh+SgPITx4F+OvEA2JJ1JtrJPLX8PsbX3d
0a/dT2iUyoItVw52VOwQCaqY9BStEi0t8FWncBOVh/4kHB0Sb3TCW2HeABWZBQPI
bmaqVIN0G0n85lYVejrtMonxAgMBAAGjggFVMIIBUTAMBgNVHRMEBTADAQH/MB0G
A1UdDgQWBBSnz0v6XxLGI3QunqOVkHWMzCZ2ljCB8QYDVR0jBIHpMIHmgBQ0cdE4
1xU2g0dr1zdkQjuOjVKdq6GBwqSBvzCBvDELMAkGA1UEBhMCVVMxEDAOBgNVBAgT
B0luZGlhbmExFTATBgNVBAcTDEluZGlhbmFwb2xpczEoMCYGA1UEChMfU29mdHdh
cmUgaW4gdGhlIFB1YmxpYyBJbnRlcmVzdDETMBEGA1UECxMKaG9zdG1hc3RlcjEe
MBwGA1UEAxMVQ2VydGlmaWNhdGUgQXV0aG9yaXR5MSUwIwYJKoZIhvcNAQkBFhZo
b3N0bWFzdGVyQHNwaS1pbmMub3JnggkA6I62yfgqFCgwLgYJYIZIAYb4QgEEBCEW
H2h0dHA6Ly9jYS5kZWJpYW4ub3JnL2NhLWNybC5wZW0wDQYJKoZIhvcNAQEFBQAD
ggIBACysOecmX8iU2UI1bY1+1qGQkOu/+3XyIVaQADXyAGToHn8yVRUDmj7Ro3A2
ina7PPAZc6GEzuSsFddk6+ttgz36Oo/i1zvC7ANwDmbgJ9+IEnyOi42faWz6PIao
hSSsrl9oxoR6NUxnhY/dsAJzTtakXLOyz6HkQV10A7MlI7JGaBWuq3BD+2YI5f2G
TWkCfTqmbuKqm50nrhvTnwHBRNUO2/3vIAGIUQaJAMThFlryyC1Ouy2o/4UlTaS9
p0e92tzYaQ/Rh83HC3rgS0hXjyCEi8Ng7sQFb3s06MsRSiPGuoBki0kBJfFqBDl4
5b2Oe2mTW5ECB73bDorsIgeiHUupHfrDFv6BE9SytS/rOmjQWgLhvtbo3908rOOa
+HB/jONtYdNwoKdb4KPxjc0I+aBRdIGep+wlexgsAoxlU/p1X92NWBFO/2sIzxml
6ynNOe96aqLGI+uscdPI7fK2pd4OFJD6dOHs5g1wvIYRgMq/w2cvyZ04PNBMJElR
pUmOHYU4wvbKD7n3FfgEu5AR6fD/N7sLD7nm9qYxbu3C8Sy7Kx7my0oxXZbLTLLX
1AstvrI9n4aFTljdybSrzPVUwgI4Ac90qXE/k+jKxHfQbOIYZSy4YOyoa+iK6Ctt
QB7Nn/SKrSiD0TViBTkB2+yQsNv9vHLBphHDsOINDj/KcwRC
-----END CERTIFICATE-----
 2 s:/C=US/ST=Indiana/L=Indianapolis/O=Software in the Public Interest/OU=hostmaster/CN=Certificate Authority/emailAddress=[e-mail]
   i:/C=US/ST=Indiana/L=Indianapolis/O=Software in the Public Interest/OU=hostmaster/CN=Certificate Authority/emailAddress=[e-mail]
-----BEGIN CERTIFICATE-----
MIIIDjCCBfagAwIBAgIJAOiOtsn4KhQoMA0GCSqGSIb3DQEBBQUAMIG8MQswCQYD
VQQGEwJVUzEQMA4GA1UECBMHSW5kaWFuYTEVMBMGA1UEBxMMSW5kaWFuYXBvbGlz
MSgwJgYDVQQKEx9Tb2Z0d2FyZSBpbiB0aGUgUHVibGljIEludGVyZXN0MRMwEQYD
VQQLEwpob3N0bWFzdGVyMR4wHAYDVQQDExVDZXJ0aWZpY2F0ZSBBdXRob3JpdHkx
JTAjBgkqhkiG9w0BCQEWFmhvc3RtYXN0ZXJAc3BpLWluYy5vcmcwHhcNMDgwNTEz
MDgwNzU2WhcNMTgwNTExMDgwNzU2WjCBvDELMAkGA1UEBhMCVVMxEDAOBgNVBAgT
B0luZGlhbmExFTATBgNVBAcTDEluZGlhbmFwb2xpczEoMCYGA1UEChMfU29mdHdh
cmUgaW4gdGhlIFB1YmxpYyBJbnRlcmVzdDETMBEGA1UECxMKaG9zdG1hc3RlcjEe
MBwGA1UEAxMVQ2VydGlmaWNhdGUgQXV0aG9yaXR5MSUwIwYJKoZIhvcNAQkBFhZo
b3N0bWFzdGVyQHNwaS1pbmMub3JnMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIIC
CgKCAgEA3DbmR0LCxFF1KYdAw9iOIQbSGE7r7yC9kDyFEBOMKVuUY/b0LfEGQpG5
GcRCaQi/izZF6igFM0lIoCdDkzWKQdh4s/Dvs24t3dHLfer0dSbTPpA67tfnLAS1
fOH1fMVO73e9XKKTM5LOfYFIz2u1IiwIg/3T1c87Lf21SZBb9q1NE8re06adU1Fx
Y0b4ShZcmO4tbZoWoXaQ4mBDmdaJ1mwuepiyCwMs43pPx93jzONKao15Uvr0wa8u
jyoIyxspgpJyQ7zOiKmqp4pRQ1WFmjcDeJPI8L20QcgHQprLNZd6ioFl3h1UCAHx
ZFy3FxpRvB7DWYd2GBaY7r/2Z4GLBjXFS21ZGcfSxki+bhQog0oQnBv1b7ypjvVp
/rLBVcznFMn5WxRTUQfqzj3kTygfPGEJ1zPSbqdu1McTCW9rXRTunYkbpWry9vjQ
co7qch8vNGopCsUK7BxAhRL3pqXTT63AhYxMfHMgzFMY8bJYTAH1v+pk1Vw5xc5s
zFNaVrpBDyXfa1C2x4qgvQLCxTtVpbJkIoRRKFauMe5e+wsWTUYFkYBE7axt8Feo
+uthSKDLG7Mfjs3FIXcDhB78rKNDCGOM7fkn77SwXWfWT+3Qiz5dW8mRvZYChD3F
TbxCP3T9PF2sXEg2XocxLxhsxGjuoYvJWdAY4wCAs1QnLpnwFVMCAwEAAaOCAg8w
ggILMB0GA1UdDgQWBBQ0cdE41xU2g0dr1zdkQjuOjVKdqzCB8QYDVR0jBIHpMIHm
gBQ0cdE41xU2g0dr1zdkQjuOjVKdq6GBwqSBvzCBvDELMAkGA1UEBhMCVVMxEDAO
BgNVBAgTB0luZGlhbmExFTATBgNVBAcTDEluZGlhbmFwb2xpczEoMCYGA1UEChMf
U29mdHdhcmUgaW4gdGhlIFB1YmxpYyBJbnRlcmVzdDETMBEGA1UECxMKaG9zdG1h
c3RlcjEeMBwGA1UEAxMVQ2VydGlmaWNhdGUgQXV0aG9yaXR5MSUwIwYJKoZIhvcN
AQkBFhZob3N0bWFzdGVyQHNwaS1pbmMub3JnggkA6I62yfgqFCgwDwYDVR0TAQH/
BAUwAwEB/zARBglghkgBhvhCAQEEBAMCAAcwCQYDVR0SBAIwADAuBglghkgBhvhC
AQ0EIRYfU29mdHdhcmUgaW4gdGhlIFB1YmxpYyBJbnRlcmVzdDAwBglghkgBhvhC
AQQEIxYhaHR0cHM6Ly9jYS5zcGktaW5jLm9yZy9jYS1jcmwucGVtMDIGCWCGSAGG
+EIBAwQlFiNodHRwczovL2NhLnNwaS1pbmMub3JnL2NlcnQtY3JsLnBlbTAhBgNV
HREEGjAYgRZob3N0bWFzdGVyQHNwaS1pbmMub3JnMA4GA1UdDwEB/wQEAwIBBjAN
BgkqhkiG9w0BAQUFAAOCAgEAtM294LnqsgMrfjLp3nI/yUuCXp3ir1UJogxU6M8Y
PCggHam7AwIvUjki+RfPrWeQswN/2BXja367m1YBrzXU2rnHZxeb1NUON7MgQS4M
AcRb+WU+wmHo0vBqlXDDxm/VNaSsWXLhid+hoJ0kvSl56WEq2dMeyUakCHhBknIP
qxR17QnwovBc78MKYiC3wihmrkwvLo9FYyaW8O4x5otVm6o6+YI5HYg84gd1GuEP
sTC8cTLSOv76oYnzQyzWcsR5pxVIBcDYLXIC48s9Fmq6ybgREOJJhcyWR2AFJS7v
dVkz9UcZFu/abF8HyKZQth3LZjQl/GaD68W2MEH4RkRiqMEMVObqTFoo5q7Gt/5/
O5aoLu7HaD7dAD0prypjq1/uSSotxdz70cbT0ZdWUoa2lOvUYFG3/B6bzAKb1B+P
+UqPti4oOxfMxaYF49LTtcYDyeFIQpvLP+QX4P4NAZUJurgNceQJcHdC2E3hQqlg
g9cXiUPS1N2nGLar1CQlh7XU4vwuImm9rWgs/3K1mKoGnOcqarihk3bOsPN/nOHg
T7jYhkalMwIsJWE3KpLIrIF0aGOHM3a9BX9e1dUCbb2v/ypaqknsmHlHU5H2DjRa
yaXG67Ljxay2oHA1u8hRadDytaIybrw/oDc5fHE2pgXfDBLkFqfF1stjo5VwP+YE
o2A=
-----END CERTIFICATE-----
---
Server certificate
subject=/O=Debian/CN=db.debian.org/emailAddress=[e-mail]
issuer=/O=Debian/CN=ca.debian.org/emailAddress=[e-mail]
---
No client certificate CA names sent
---
SSL handshake has read 5522 bytes and written 645 bytes
---
New, TLSv1/SSLv3, Cipher is RC4-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: zlib compression
Expansion: zlib compression
SSL-Session:
    Protocol  : TLSv1
    Cipher    : RC4-SHA
    Session-ID: AE11B49C73A0BF9479BED9F999624AB62BC2615D59376FBBFF62AB3DFF089849
    Session-ID-ctx: 
    Master-Key: EE31752114A0FFE9976D04807781F456C267C72AFA061CF1B3C55AEF173310B3334A8F2D9BECC3D0E1ED23F5E3CA38EF
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket:
    0000 - 0e 81 5a 61 54 86 14 4e-f9 44 5f 98 53 7f bf f9   ..ZaT..N.D_.S...
    0010 - 03 5f ac 94 88 52 55 2c-32 21 84 0b 29 34 ad b0   ._...RU,2!..)4..
    0020 - dd b6 04 9f c0 46 72 2f-a7 88 08 0c a5 e3 3f 34   .....Fr/......?4
    0030 - 25 4a 1a bf e0 02 53 4c-db f2 d2 11 d6 b2 da 1b   %J....SL........
    0040 - d8 c6 0f d6 f1 00 34 5c-95 07 73 a2 f3 fa 4c 70   ......4\..s...Lp
    0050 - 83 3b 68 b7 d9 f7 70 08-39 91 40 a2 0a 5b 39 3b   .;h...p.9.@..[9;
    0060 - 07 49 58 6f 65 84 68 ab-6d 37 d7 88 03 7b a5 67   .IXoe.h.m7...{.g
    0070 - ce 23 89 e0 01 fb 67 1f-77 63 3f c8 e1 5f 84 f0   .#....g.wc?.._..
    0080 - 23 cb 17 17 d9 f0 e8 ae-02 72 e0 f9 95 de 77 4f   #........r....wO
    0090 - 9d 38 67 b9 3a 16 de ca-70 e3 e4 e1 cc 3d 11 27   .8g.:...p....=.'
    00a0 - b4 ef 09 dc 0e 12 2e cb-79 46 25 b7 8c 05 a4 3a   ........yF%....:
    00b0 - 55 ef ad 57 fd 16 73 9a-91 93 83 67 61 5d 0f 97   U..W..s....ga]..

    Compression: 1 (zlib compression)
    Start Time: 1341324525
    Timeout   : 300 (sec)
    Verify return code: 19 (self signed certificate in certificate chain)
---

Comment 7

[Zack Weinberg (:zwol)]

Apparently NSS is its own product.  *headdesk*