Dear Maintainer,

Something is wrong with how libnss3 is verifying chains.

I first noticed this with pidgin with irc.oftc.net, but I can reproduce this
without needing pidgin (hence I don't think this is a pidgin bug).
Interestingly, Firefox (and I presume Thunderbird, but haven't checked this)
is unaffected.

To see this issue, run (I'm using Google here as I'd expect them to have the
chains correctly set up, and for any breakage to be noticed really quickly, but
other systems give the same error):

$ vfyserv -c google.com -p 443

which gives

Connecting to host google.com (addr 142.250.76.110) on port 443
Cert file cert.000 was created.
PROBLEM WITH THE CERT CHAIN:
CERT 0. CN=*.google.com :
  ERROR -8179: Peer's Certificate issuer is not recognized.
    CN=WR2,O=Google Trust Services,C=US
Error in function PR_Write: -8179
 - Peer's Certificate issuer is not recognized.

OpenSSL seems to have no issues either, with

$ openssl s_client -showcerts -connect google.com:443
Connecting to 142.250.204.14
CONNECTED(00000003)
depth=2 C=US, O=Google Trust Services LLC, CN=GTS Root R1
verify return:1
depth=1 C=US, O=Google Trust Services, CN=WR2
verify return:1
depth=0 CN=*.google.com
verify return:1

being the start of the response from OpenSSL.

I think this is a recent regression, but I haven't tested older versions of
libnss3.

I've also set this as important, given at least some clients are having no
issues, but feel free to change the severity as needed.

Regards
James

clone 1078468 -1
reassign -1 libpurple0
forwarded -1 https://issues.imfreedom.org/issue/PIDGIN-17886/Certificate-verification-errors-with-NSS-3.103
thanks

See the discussion in https://bugzilla.mozilla.org/show_bug.cgi?id=1913047

This bug should have been fixed along with pidgin 2.14.14.