99610 - SSL-client auth broken for SSL/SMTP

Status: VERIFIED WORKSFORME

(Core Graveyard :: Security: UI, defect, P1)

Description

[Bob Lord]

One two occasions I've had the following problem with SSL/SMTP.  

Setup:  
-My primary AOL cert is on my smartcard.  
-I have a "sectest" cert on the internal token.
-Manual cert select
-Win2K

Although I've sent email in the past (by selecting my cert and typing my key3.db
password), the client re-prompts me to select a cert.  Instead of asking me to
select between the sectest cert and the real AOL cert, the client only gives me
the option to select the sectest cert.  It doesn't see the smart card anymore!
I select the sectest cert.  The client then asks me for my nsmail-1 username and
password, which tells me the server does not like the sectest cert.  I type it
in, and I get an error.

I'll attach some screenshots.

Comment 1

[Bob Lord]

Attachment: missing smart card

Comment 2

[Bob Lord]

Attachment: asking for my ldap password

Comment 3

[Bob Lord]

Attachment: double error message

Comment 4

[Stephane Saux]

target 2.2
P1

Comment 5

[Bob Lord]

I'm wondering if this problem is tied to my occasional use of Communicator to
read encrypted emails.  

Comment 6

[Stephane Saux]

it's true that there's no guarantee that the hardware token drivers behave
gracefully with several process accessing them.

Comment 7

[Antonio Lam]

Using today build: 2001-10-08-05-0.9.4, It seems that I am able to send the 
message with SSL turn on w/o a smartcard, but the client still re-prompt me to 
select the cert if I haven't login to the mail server yet (eg. Sending mail via 
SMAPI with no mozilla mail client running):

Setup:
- My AOL cert on the internal token.
- "Sectest" cert  on the internal token.
- Manual cert select
- "Always use SSL" on Outgoing mail server
- Windows NT 4.0
- Dredd (NMS 4.15) mail server

Step to reproduce:

1) Compose and send a message
2) "User Identification Request" dialog popup to ask me to choose a cert
3) Select a cert (my primary AOL cert)
4) Enter the master password for security device
5) "User Identification Request" dialog popup again (should not be)
6) Select the same cert, and the mail is delivered with no errors

If I have already login to the mail server (either via plain text or client cert 
auth), the cert dialog will not popup again.

Comment 8

[Stephane Saux]

Antonio:
The fact that you get to pick the cert twice is normal:
You choose it once for the SMTP/SSL, and once when send message attempts to copy
the message to the IMAP server. There are two servers and two cert picker.
What you're describing isn't IMO a bug. Bob's issue was different, and may or
may not still be reproducible.

Comment 9

[Mark Shuttleworth]

Am having trouble sending email over SMTP with SSL. Outgoing SMTP mail server is
different to the incoming IMAP server. Server is franklin.tsf.org.za. Works fine
with Communicator 4.79. Requires client auth. Don't see any cert selection box.
Mozilla is set to 'ask every time' under
Edit->Preferences->Privacy&Security->Certificates.

Comment 10

[John Unruh]

Marking works for me. I cannot reproduce the original bug.

Comment 11

[John Unruh]

Verified.