755227 - Bug building a certificate chain

Status: RESOLVED DUPLICATE of bug 386871

(NSS :: CA Certificates Code, task)

Description

[Manel Rella]

Attachment: Tests for building certificate chain in Firefox

User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30618)

Steps to reproduce:

We have tried to build a correct certification chain in Firefox (you can see the detailed steps in the attatched file).


Actual results:

The chain is not build correctly as happens with many other systems (see the attatched file for details)


Expected results:

The certification chain should be builded and validated

Comment 1

[Kathleen Wilson]

I manually imported each of the certs from her:
http://www.catcert.cat/content/download/6700/16189/file/EV_certificate.zip

When I view the EC-SAFP certificate I see that it chains up to EC-GENCAT, which chains up to EC-ACC. That part seems fine.

However, when I view the www.ecoviat.com cert, it doesn't show the cert chain.

www.ecoviat.com Issuer:
CN = EC-SAFP
OU = Secretaria d'Administracio i Funcio Publica
OU = "Vegeu https://www.catcert.net/verCIC-2   (c)03"
OU = Serveis Publics de Certificacio ECV-2
L = Passatge de la Concepcio 11 08008 Barcelona
O = Agencia Catalana de Certificacio (NIF Q-0801176-I)
C = ES


EC-SAFP Subject:
CN = EC-SAFP
OU = Secretaria d'Administracio i Funcio Publica
OU = "Vegeu https://www.catcert.net/verCIC-2   (c)03"
OU = Serveis Publics de Certificacio ECV-2
L = Passatge de la Concepcio 11 08008 Barcelona
O = Agencia Catalana de Certificacio (NIF Q-0801176-I)
C = ES


Seems to match, but the chaining doesn't happen.

From CATCert: 
we also think the problem is that the hierarchy has UTF‐8 codification and the SSL certificate has PrintableString, and maybe the algorithm that uses Firefox for building the certification chain is affected by this.

Comment 2

[Kathleen Wilson]

NSS Team: Does NSS support a cert hierarchy where the root and intermediate certs use UTF-8, but the end-entity cert uses PrintableString?

Comment 3

[Kaspar]

(In reply to Kathleen Wilson from comment #2)
> Does NSS support a cert hierarchy where the root and intermediate
> certs use UTF-8, but the end-entity cert uses PrintableString?

No, it doesn't. More precisely, the issuer DN of a cert must use the very same ASN.1 string encodings as the subject DN of its issuer cert, otherwise the certs won't chain in NSS.

What can be observed with the cert for www.ecoviat.com and the [new] ICA cert from http://www.catcert.cat/descarrega/gencat_sha2.crt (which BTW should serve the cert itself and not redirect to another URI, see RFC 5280 section 4.2.2.1) is exactly the same behavior as described in bug 398153 comment 3.

Comment 4

[Kathleen Wilson]

Thanks!

Looks like this is also a duplicate of bug #386871.