83130 - Can only get rsa-dual-use certs.

Status: VERIFIED FIXED

(Core Graveyard :: Security: UI, defect, P2)

Description

[John Unruh]

5/29 WinNT Netscape 6 build. Here are the test results.
1.) Single Click 1024 rsa-dual-use - 
https://junruh.mcom.com:444/DirUserEnroll.html - Pass
2.) Signing Only Key  2048 bits with rsa-sign - 
https://junruh.mcom.com:444/DirUserEnrollSign.html Submit button does nothing.
3.) Key Escrow  512 bits with rsa-ex - 
https://junruh.mcom.com:444/DirUserEnrollEncrypt.html An Error was encountered 
while filling certificate with contents of the CRMF message.
4.) Dual key 1024 bits with rsa-ex & rsa-sign - 
https://junruh.mcom.com:444/DirUserEnrollDual.html An Error was encountered 
while filling certificate with contents of the CRMF message.
5.) Single Click forced Backup 2048 bits with rsa-dual-use - 
https://junruh.mcom.com:444/backup/DirUserEnroll.html - Pass
6.) Signing Only Key forced backup 512 bits with rsa-sign - 
https://junruh.mcom.com:444/backup/DirUserEnrollSign.html - Submit button does 
nothing.
7.) Key Escrow with forced Backup 1024 bits with rsa-ex - 
https://junruh.mcom.com:444/backup/DirUserEnrollEncrypt.html - An Error was 
encountered while filling certificate with contents of the CRMF message.
8.) Dual Key with forced Backup - 2048 bits rsa-ex &rsa-sign - 
https://junruh.mcom.com:444/backup/DirUserEnrollDual.html - An Error was 
encountered while filling certificate with contents of the CRMF message.
9.) Certificate Renewal server - 
https://gilbeys.red.iplanet.com:80/DirUserEnroll.html - Pass
10.) KeyGen - https://gilbeys.red.iplanet.com:80/DirUserEnrollKeyGen.html - 
Fails, shows blank page after 20 seconds.

Comment 1

[John Unruh]

*** Bug 65748 has been marked as a duplicate of this bug. ***

Comment 2

[Stephane Saux]

Using linux build ID 2001052908.
agree with John on 1),2),3),4)
5), I get an "exit 139" (no core file. The browser exits).
6),7),8),9),10). agree.
Moreover, the dialog box displaying the "Important: this certificate authority
has asked to make a backup of your encryption key...." info is too small. The
buttons at the bottom are only partially visible.

Comment 3

[Bob Lord]

-> javi

Comment 4

[Bob Lord]

-> 2.0, P2

Comment 5

[Stephane Saux]

Mass reassigning target to 2.1

Comment 6

[Bob Lord]

Moving back to 2.0. The client must perform all CRMF functions correctly.  Some
of these broken cases are deployment showstoppers.

Comment 7

[Bob Lord]

Javi points out that junruh's tests #3 and #7 depend on NSS bug 80416.  I've
added that dependency.

Comment 8

[Bob Lord]

For the moment, I'm most interested in getting updates on 2, 4, and 8.  Can we
get more information on those bugs?  Do they still exist?

We'll need to fix the escrow bugs before we release the S/MIME client.

Comment 9

[Bob Lord]

Regarding #10, I got a Verisign cert yesterday from this site:
https://digitalid.verisign.com/client/class1Netscape.htm
It uses KEYGEN.

Are there still KEYGEN problems?

Comment 10

[John Unruh]

After retesting the 10 original sites with 6/25 WinNT branch, nothing has 
changed.

Comment 11

[John Unruh]

Tests 2 and 6 pass now also.

Comment 12

[John Unruh]

Fixed. The web pages were updated to remove Key Escrow.

Comment 13

[John Unruh]

Verified.