#589023 iceweasel: SSL/X509 Certificate for 'AddTrust External CA Root' not recognized as valid

Package:
iceweasel
Source:
firefox-esr
Submitter:
Frank Lin PIAT
Date:
2011-08-06 09:22:23 UTC
Severity:
normal
Tags:
#589023#5
Date:
2010-07-14 11:27:12 UTC
From:
To:
Hello,

When I visit https://www.gandi.net, the certificate isn't trusted/recognized.
I can reproduce the problem with https://www.comodo.com
  Error title: "This Connection is Untrusted"
  Error code: sec_error_unknown_issuer

The certificates hierarchy goes like this (notice the loop):
 www.gandi.net
  `-> COMODO EV SGC CA
      `-> AddTrust External CA Root
          `-> UTN - DATACorp SGC
              `-> AddTrust External CA Root
                  `-> UTN - DATACorp SGC
                      `-> AddTrust External CA Root
                          `-> (loop continues)

 www.comodo.com
  `-> COMODO EV SGC CA
      `-> AddTrust External CA Root
          `-> UTN - DATACorp SGC
              `-> AddTrust External CA Root
                  `-> UTN - DATACorp SGC
                      `-> AddTrust External CA Root
                          `-> (loop continues)


Other web browsers (epiphany/Deb, chrome/Deb, firefox 3.6.3/Win, Safari/Win)
and openssl's CLI don't exhibit this loop behaviour.
(I have submited a webshots session... we'll see how other browsers do
on http://browsershots.org/https://www.comodo.com/ )

The certificate "AddTrust External CA Root" is supposed to be
enabled/trusted on my system:

And it seems valid:

openssl verify -verbose /usr/share/ca-certificates/mozilla/AddTrust_External_Root.crt



OpenSSL seems happy with it, and doesn't loop:

and

Regards,

Franklin

#589023#10
Date:
2010-07-14 11:43:21 UTC
From:
To:
Both work here.

(...)

Unfortunately, these are not used by Iceweasel/libnss3.

The interesting data point in your report, though, is that it works with
chrome/deb. Chrome, like Iceweasel, uses libnss3, though unless you
tested with chromium-browser, I'm unsure it uses the system library.

Anyways, as it works properly here, I suspect something fishy with the
certificate database in your user profile.

Can you first check if that works better if you try with a new profile
(you can use a new user account, or run iceweasel -P to create a new
profile). If so, I invite you to check in Edit > Preferences > Advanced

Mike

#589023#15
Date:
2010-07-14 16:17:30 UTC
From:
To:
The new profile is OK (I should have tested that rather than make wrong
assumption).

I investigated... In the OK profile, the "AddTrust External CA Root"
certificate is selfsigned, whereas the certificates are differents on
the KO profile (and they make a loop!):

/usr/bin/certutil -L -d /home/fpiat/.mozilla/firefox/*.default/ -a -n "AddTrust External CA Root"  | openssl x509 -noout -issuer -subject

/usr/bin/certutil -L -d /home/fpiat/.mozilla/firefox/*.default/ -a -n "UTN - DATACorp SGC"  | openssl x509 -noout -issuer -subject

I wonder where I got those certificates from, and if others could be affected.

<me thinking>
If I understand how NSS work properly, it means that NSS is "learning"
certificates chains (i.e adding certificates to it's database) as it is
receiving certificates from visited websites.

This fuzzy / unpredictable behavior scares me.
</me thinking>

Anyway, I removed the "Software Security Device" entries, and it's now
working:
UTN - DATACorp SGC
 `-> AddTrust External CA Root
     `-> COMODO EV SGC CA
          `-> www.comodo.com

Regards,

Franklin

#589023#20
Date:
2010-07-14 16:49:15 UTC
From:
To:
AFAIK, it doesn't.

The "AddTrust External CA Root" certificate is provided by the "builtin
object token", so it shouldn't have been broken in the first place. Are
you sure you never imported a broken certificate?

Do you have a backup of your firefox profile directory? If you don't
have any private key stored in it, would you mind providing the *.db
files from there?

Cheers,

Mike

#589023#25
Date:
2010-07-14 20:43:02 UTC
From:
To:
I have no clue how that certificate ended up on my laptop. I am
extremely reluctant to add CA certificate to my laptop, I doubt I ever
did that (and when I see the amount of "Software Security Device", I am
pretty sure I didn't import them all myself :-/ )

The "AddTrust External CA Root" certificate I removed is the one under
"The USERTRUST Network", which type was "Software Security Device":
 CN = AddTrust External CA Root
 OU = AddTrust External TTP Network
 O = AddTrust AB
 C = SE

I did *not* remove the certificate "AddTrust External CA Root" filed
under "AddTrust AB",  which type was "Builtin Object Token" already.

I have attached both certificates (.pem and .txt)

I am sending it the .db files privately


Franklin

#589023#30
Date:
2010-07-15 08:00:12 UTC
From:
To:
that was added to the database. It looks like iceweasel does that for
intermediate certificates, like, I believe, most if not all browsers.

Now, there are 3 questions that should be answered:
- where does your additional (broken) AddTrust External CA Root cert
  come from?
- why is broken?
- why does iceweasel/nss doesn't allows such broken situations,
  especially when there is another AddTrust External CA Root cert?

The first is primordial, I think, because it would help understand how
you got this certificate in the first place.

The second might be related to the UTN - DATACorp SGC cert. In the builtin
token, it is issued by AddTrust External CA Root, which introduces the
loop. But there are chances that the UTN - DATACorp SGC key it was
actually issued from had a different certificate associated with it by
the time, not issued by AddTrust External CA Root.

For the latter, I don't know what to think. It's apparently not going to
be a security issue. Only a nuisance in that certificates issued by the
half broken CA will be shown as invalid. I'll think a bit more about it
and probably file a bug upstream.

Mike

#589023#35
Date:
2011-04-23 06:20:52 UTC
From:
To:
Hi!

A quick note to say that I had the exact same problem here: unable to
access https://www.gandi.net because of the loop and solved by
deleting the certificate "The USERTRUST Network" -> "Addtrust External
CA Root" (which was from "Software Security Device").

- -- Package-specific info:

- -- Plugins information
Name: IcedTea NPR Web Browser Plugin (using IcedTea6 1.8.7 (6b18-1.8.7-2))
Location: /usr/lib/jvm/java-6-openjdk/jre/lib/amd64/IcedTeaPlugin.so
Package: icedtea6-plugin
Status: enabled

Name: Shockwave Flash
Location: /usr/lib/flashplugin-nonfree/libflashplayer.so
Status: enabled


- -- Addons package information
ii  icedtea6-plugi 6b18-1.8.7-2   web browser plugin based on OpenJDK and Iced

- -- System Information:
Debian Release: wheezy/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (101, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 2.6.38-2-amd64 (SMP w/2 CPU cores)
Locale: LANG=fr_FR.utf8, LC_CTYPE=fr_FR.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages iceweasel depends on:
ii  debianutils                   3.4.4      Miscellaneous utilities specific t
ii  fontconfig                    2.8.0-2.2  generic font configuration library
ii  libc6                         2.11.2-13  Embedded GNU C Library: Shared lib
ii  libglib2.0-0                  2.28.6-1   The GLib library of C routines
ii  libgtk2.0-0                   2.24.4-3   The GTK+ graphical user interface
ii  libnspr4-0d                   4.8.7-2    NetScape Portable Runtime Library
ii  libstdc++6                    4.6.0-4    The GNU Standard C++ Library v3
ii  procps                        1:3.2.8-10 /proc file system utilities
ii  xulrunner-2.0                 2.0-3      XUL + XPCOM application runner

iceweasel recommends no packages.

Versions of packages iceweasel suggests:
ii  libgssapi-krb5-2           1.9+dfsg-1+b1 MIT Kerberos runtime libraries - k
pn  mozplugger                 <none>        (no description available)
ii  ttf-lyx                    2.0.0~rc3-2   TrueType versions of some TeX font
pn  ttf-mathematica4.1         <none>        (no description available)
ii  xfonts-mathml              4             Type1 Symbol font for MathML
pn  xprint                     <none>        (no description available)

Versions of packages xulrunner-2.0 depends on:
ii  libasound2       1.0.23-3                shared library for ALSA applicatio
ii  libatk1.0-0      2.0.0-1                 The ATK accessibility toolkit
ii  libbz2-1.0       1.0.5-6                 high-quality block-sorting file co
ii  libc6            2.11.2-13               Embedded GNU C Library: Shared lib
ii  libcairo2        1.10.2-6                The Cairo 2D vector graphics libra
ii  libdbus-1-3      1.4.8-2                 simple interprocess messaging syst
ii  libevent-1.4-2   1.4.13-stable-1         An asynchronous event notification
ii  libfontconfig1   2.8.0-2.2               generic font configuration library
ii  libfreetype6     2.4.4-1                 FreeType 2 font engine, shared lib
ii  libgcc1          1:4.6.0-4               GCC support library
ii  libglib2.0-0     2.28.6-1                The GLib library of C routines
ii  libgtk2.0-0      2.24.4-3                The GTK+ graphical user interface
ii  libhunspell-1.2- 1.2.14-4                spell checker and morphological an
ii  libjpeg62        6b1-1                   The Independent JPEG Group's JPEG
ii  libmozjs4d       2.0-3                   The Mozilla SpiderMonkey JavaScrip
ii  libnspr4-0d      4.8.7-2                 NetScape Portable Runtime Library
ii  libnss3-1d       3.12.9.with.ckbi.1.82-1 Network Security Service libraries
ii  libpango1.0-0    1.28.3-6                Layout and rendering of internatio
ii  libpixman-1-0    0.21.6-2                pixel-manipulation library for X a
ii  libreadline6     6.1-3                   GNU readline and history libraries
ii  libsqlite3-0     3.7.5-1                 SQLite 3 shared library
ii  libstartup-notif 0.10-1                  library for program launch feedbac
ii  libstdc++6       4.6.0-4                 The GNU Standard C++ Library v3
ii  libvpx0          0.9.6-1                 VP8 video codec (shared library)
ii  libx11-6         2:1.4.3-1               X11 client-side library
ii  libxext6         2:1.2.0-2               X11 miscellaneous extension librar
ii  libxrender1      1:0.9.6-1               X Rendering Extension client libra
ii  libxt6           1:1.1.1-1               X11 toolkit intrinsics library
ii  zlib1g           1:1.2.3.4.dfsg-3        compression library - runtime

Versions of packages xulrunner-2.0 suggests:
ii  libcanberra0                  0.24-1     a simple abstract interface for pl
ii  libdbus-glib-1-2              0.92-1     simple interprocess messaging syst
ii  libgconf2-4                   2.28.1-6   GNOME configuration database syste
ii  libgnomeui-0                  2.24.3-1   The GNOME libraries (User Interfac
ii  libgnomevfs2-0                1:2.24.4-1 GNOME Virtual File System (runtime
ii  libnotify1 [libnotify1-gtk2.1 0.5.0-2    sends desktop notifications to a n

- -- no debconf information
iEYEARECAAYFAk2yb8AACgkQKFvXofIqeU5adACfbAED2cq0njmSnvZoFZNDxLmM
7toAn3xfkMu8pZZ9bxlQql3QbB2E4yBD
=IsRh
-----END PGP SIGNATURE-----