988166 - CERTUM's EV certificates are not treated as EV after updating to Firefox 28

Status: RESOLVED FIXED

(CA Program :: CA Certificate Root Program, task)

Description

[Michal Proszkiewicz]

Attachment: firefox_28_noEV_PL.png

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1750.154 Safari/537.36

Steps to reproduce:

1. Update Firefox to version 28 stable
2. Enter https://www.certum.pl
3. Certificate shold be treated as EV (and it is not)


Actual results:

EV certificate is treated as standard SSL certificate.


Expected results:

Certificate should be treated as EV certificate.

Comment 1

[Michal Proszkiewicz]

Bug above has been reproduced on several computers in our company (all Windows 7 AFAIK).

Comment 2

[Kathleen Wilson]

I think the problem is that the intermediate certificate does not provide an OCSP URI in the AIA, which we require for EV treatment, and started programmatically enforcing in Firefox 28.

References:

https://wiki.mozilla.org/CA:ImprovingRevocation#No_EV_Treatment_when_OCSP_Fails_or_Not_Provided

https://wiki.mozilla.org/PSM:EV_Testing_Easy_Version#Not_Getting_EV_Treatment.3F

Comment 3

[Kathleen Wilson]

(In reply to Kathleen Wilson from comment #2)
> I think the problem is that the intermediate certificate does not provide an
> OCSP URI in the AIA, which we require for EV treatment, and started
> programmatically enforcing in Firefox 28.

Actually, the OCSP URI in the AIA isn't required if OCSP Stapling is used...

EV Treatment will not be given when the OCSP response fails or cannot be retrieved for end-entity and intermediate certificates.

Comment 4

[Michal Proszkiewicz]

It seems, that changing intermediates to the ones that have OCSP AIA extension solved this issue.

We would be glad if you confirm that this was the case. If so this bug may be closed.

Comment 5

[Kathleen Wilson]

Tested -- getting EV treatment now.