823342 - Cannot import self-signed certificate from server

Status: RESOLVED FIXED

(Core Graveyard :: Security: UI, defect)

Description

[Ian Neal]

Somewhere between 17 and 20 this has broken.

STR
1. On a mail server generate a self-signed certificate (RSA 2048) and use it for SSL.
2. On client computer point at the mail server with SSL.
3. Prompted to import certificate.

Actual results
1/ Certificate is not retrieved.
2/ "Confirm Security Exception" button is disabled.

Expected results
1/ Certificate is retrieved.
2/ Can add a security exception.

Using openssl s_client from the client computer shows the certificate can be successfully retrieved.

Comment 1

[Ian Neal]

2012-11-19-00-30-11 works
2012-12-19-00-30-27 fails

Comment 2

[Ian Neal]

2012-12-03-00-30-11 works
2012-12-11-00-30-44 works
2012-12-13-00-30-11 fails
2012-12-15-00-30-13 fails
Unfortunately there are no linux builds from 2012-12-12 to test.
http://hg.mozilla.org/mozilla-central/pushloghtml?startdate=2012-12-11+00%3A30%3A44&enddate=2012-12-13+00%3A30%3A11
Maybe something to do with bug 769288 ?

Message in error console:
Timestamp: 20/12/12 02:14:27
Error: Attempted to connect to a site with a bad certificate in the add exception dialog. This results in a (mostly harmless) exception being thrown. Logged for information purposes only: [Exception... "Establishing a connection to an unsafe or otherwise banned port was prohibited"  nsresult: "0x804b0013 (NS_ERROR_PORT_ACCESS_NOT_ALLOWED)"  location: "JS frame :: chrome://pippki/content/exceptionDialog.js :: checkCert :: line 140"  data: no]
Source File: chrome://pippki/content/exceptionDialog.js
Line: 148

Comment 3

[Ian Neal]

(In reply to Ian Neal from comment #2)
> 2012-12-03-00-30-11 works
> 2012-12-11-00-30-44 works
> 2012-12-13-00-30-11 works
> 2012-12-15-00-30-13 fails
Sorry, typo.

Comment 4

[Josh Matthews [:jdm]]

Ack, here's the problem:

http://mxr.mozilla.org/mozilla-central/source/security/manager/pki/resources/content/exceptionDialog.js#95

getRecentBadCertsService was renamed getRecentBadCerts in one of the revisions. This file should be updated.

Comment 5

[Jonathan Kamens]

I just ran into this under Thunderbird. I bisected Thunderbird nightly builds and found that the problem was introduced between the 2012-12-13 and 2012-12-14 builds. From the comments above, it looks like you already know what's wrong, but I thought I'd mention this just in case it's useful.

Comment 6

[Josh Matthews [:jdm]]

Attachment: Update reference to renamed getRecentBadCertsService method.

Comment 7

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Comment on attachment 694420 [details] [diff] [review]
Update reference to renamed getRecentBadCertsService method.

Review of attachment 694420 [details] [diff] [review]:
-----------------------------------------------------------------

ty.

Comment 8

[Josh Matthews [:jdm]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/0e08a2cc3b07

Comment 9

[:Ms2ger (he/him; ⌚ UTC+1/+2)]

https://hg.mozilla.org/mozilla-central/rev/0e08a2cc3b07