91960 - No warning of certificates when site use different certificates.

Status: VERIFIED FIXED

(Core Graveyard :: Security: UI, defect, P3)

Description

[Yannick Koehler]

I went to a secure web site, and asked mozilla to saved the certificate
permanentely.  But after a while I returned to the same web site and their
certificates had changed but mozilla didn't warn me of this and instead told me
that the certificate was no more valid and had expired.

Closer investigation revealed that mozilla was using his stored certificates and
not the new cert from the site.  I was unable to tell mozilla to use the new one
instead without going in the prefs and deleting the site's cert.

My problem is more that mozilla didn't warn me in any of my attempt to connect
to the site that the certificates changed at all.  Which I think is really bad.

Comment 1

[Mitchell Stoltz (not reading bugmail)]

->PSM

Comment 2

[Stephane Saux]

->future
Although this is a problem, the vast majority of ssl sites (and all the most
important) ones have certificates that don't require the user to accept the cert
individually as it's signed by a built in certificate authority.
->ddrinan

Comment 3

[John Unruh]

Mass assigning QA to ckritzer.

Comment 4

[Scott MacGregor]

*** Bug 96026 has been marked as a duplicate of this bug. ***

Comment 5

[John Unruh]

Marking fixed. I am simply presented with the new certificate to either accept, 
cancel, or remember.

Comment 6

[John Unruh]

Verified.