#589023 iceweasel: SSL/X509 Certificate for 'AddTrust External CA Root' not recognized as valid #589023
- Package:
- iceweasel
- Source:
- firefox-esr
- Submitter:
- Frank Lin PIAT
- Date:
- 2011-08-06 09:22:23 UTC
- Severity:
- normal
- Tags:
Hello,
When I visit https://www.gandi.net, the certificate isn't trusted/recognized.
I can reproduce the problem with https://www.comodo.com
Error title: "This Connection is Untrusted"
Error code: sec_error_unknown_issuer
The certificates hierarchy goes like this (notice the loop):
www.gandi.net
`-> COMODO EV SGC CA
`-> AddTrust External CA Root
`-> UTN - DATACorp SGC
`-> AddTrust External CA Root
`-> UTN - DATACorp SGC
`-> AddTrust External CA Root
`-> (loop continues)
www.comodo.com
`-> COMODO EV SGC CA
`-> AddTrust External CA Root
`-> UTN - DATACorp SGC
`-> AddTrust External CA Root
`-> UTN - DATACorp SGC
`-> AddTrust External CA Root
`-> (loop continues)
Other web browsers (epiphany/Deb, chrome/Deb, firefox 3.6.3/Win, Safari/Win)
and openssl's CLI don't exhibit this loop behaviour.
(I have submited a webshots session... we'll see how other browsers do
on http://browsershots.org/https://www.comodo.com/ )
The certificate "AddTrust External CA Root" is supposed to be
enabled/trusted on my system:
And it seems valid:
openssl verify -verbose /usr/share/ca-certificates/mozilla/AddTrust_External_Root.crt
OpenSSL seems happy with it, and doesn't loop:
and
Regards,
Franklin
Both work here. (...) Unfortunately, these are not used by Iceweasel/libnss3. The interesting data point in your report, though, is that it works with chrome/deb. Chrome, like Iceweasel, uses libnss3, though unless you tested with chromium-browser, I'm unsure it uses the system library. Anyways, as it works properly here, I suspect something fishy with the certificate database in your user profile. Can you first check if that works better if you try with a new profile (you can use a new user account, or run iceweasel -P to create a new profile). If so, I invite you to check in Edit > Preferences > Advanced Mike
The new profile is OK (I should have tested that rather than make wrong
assumption).
I investigated... In the OK profile, the "AddTrust External CA Root"
certificate is selfsigned, whereas the certificates are differents on
the KO profile (and they make a loop!):
/usr/bin/certutil -L -d /home/fpiat/.mozilla/firefox/*.default/ -a -n "AddTrust External CA Root" | openssl x509 -noout -issuer -subject
/usr/bin/certutil -L -d /home/fpiat/.mozilla/firefox/*.default/ -a -n "UTN - DATACorp SGC" | openssl x509 -noout -issuer -subject
I wonder where I got those certificates from, and if others could be affected.
<me thinking>
If I understand how NSS work properly, it means that NSS is "learning"
certificates chains (i.e adding certificates to it's database) as it is
receiving certificates from visited websites.
This fuzzy / unpredictable behavior scares me.
</me thinking>
Anyway, I removed the "Software Security Device" entries, and it's now
working:
UTN - DATACorp SGC
`-> AddTrust External CA Root
`-> COMODO EV SGC CA
`-> www.comodo.com
Regards,
Franklin
AFAIK, it doesn't. The "AddTrust External CA Root" certificate is provided by the "builtin object token", so it shouldn't have been broken in the first place. Are you sure you never imported a broken certificate? Do you have a backup of your firefox profile directory? If you don't have any private key stored in it, would you mind providing the *.db files from there? Cheers, Mike
I have no clue how that certificate ended up on my laptop. I am extremely reluctant to add CA certificate to my laptop, I doubt I ever did that (and when I see the amount of "Software Security Device", I am pretty sure I didn't import them all myself :-/ ) The "AddTrust External CA Root" certificate I removed is the one under "The USERTRUST Network", which type was "Software Security Device": CN = AddTrust External CA Root OU = AddTrust External TTP Network O = AddTrust AB C = SE I did *not* remove the certificate "AddTrust External CA Root" filed under "AddTrust AB", which type was "Builtin Object Token" already. I have attached both certificates (.pem and .txt) I am sending it the .db files privately Franklin
that was added to the database. It looks like iceweasel does that for intermediate certificates, like, I believe, most if not all browsers. Now, there are 3 questions that should be answered: - where does your additional (broken) AddTrust External CA Root cert come from? - why is broken? - why does iceweasel/nss doesn't allows such broken situations, especially when there is another AddTrust External CA Root cert? The first is primordial, I think, because it would help understand how you got this certificate in the first place. The second might be related to the UTN - DATACorp SGC cert. In the builtin token, it is issued by AddTrust External CA Root, which introduces the loop. But there are chances that the UTN - DATACorp SGC key it was actually issued from had a different certificate associated with it by the time, not issued by AddTrust External CA Root. For the latter, I don't know what to think. It's apparently not going to be a security issue. Only a nuisance in that certificates issued by the half broken CA will be shown as invalid. I'll think a bit more about it and probably file a bug upstream. Mike
Hi! A quick note to say that I had the exact same problem here: unable to access https://www.gandi.net because of the loop and solved by deleting the certificate "The USERTRUST Network" -> "Addtrust External CA Root" (which was from "Software Security Device"). - -- Package-specific info: - -- Plugins information Name: IcedTea NPR Web Browser Plugin (using IcedTea6 1.8.7 (6b18-1.8.7-2)) Location: /usr/lib/jvm/java-6-openjdk/jre/lib/amd64/IcedTeaPlugin.so Package: icedtea6-plugin Status: enabled Name: Shockwave Flash Location: /usr/lib/flashplugin-nonfree/libflashplayer.so Status: enabled - -- Addons package information ii icedtea6-plugi 6b18-1.8.7-2 web browser plugin based on OpenJDK and Iced - -- System Information: Debian Release: wheezy/sid APT prefers unstable APT policy: (500, 'unstable'), (101, 'experimental') Architecture: amd64 (x86_64) Kernel: Linux 2.6.38-2-amd64 (SMP w/2 CPU cores) Locale: LANG=fr_FR.utf8, LC_CTYPE=fr_FR.utf8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Versions of packages iceweasel depends on: ii debianutils 3.4.4 Miscellaneous utilities specific t ii fontconfig 2.8.0-2.2 generic font configuration library ii libc6 2.11.2-13 Embedded GNU C Library: Shared lib ii libglib2.0-0 2.28.6-1 The GLib library of C routines ii libgtk2.0-0 2.24.4-3 The GTK+ graphical user interface ii libnspr4-0d 4.8.7-2 NetScape Portable Runtime Library ii libstdc++6 4.6.0-4 The GNU Standard C++ Library v3 ii procps 1:3.2.8-10 /proc file system utilities ii xulrunner-2.0 2.0-3 XUL + XPCOM application runner iceweasel recommends no packages. Versions of packages iceweasel suggests: ii libgssapi-krb5-2 1.9+dfsg-1+b1 MIT Kerberos runtime libraries - k pn mozplugger <none> (no description available) ii ttf-lyx 2.0.0~rc3-2 TrueType versions of some TeX font pn ttf-mathematica4.1 <none> (no description available) ii xfonts-mathml 4 Type1 Symbol font for MathML pn xprint <none> (no description available) Versions of packages xulrunner-2.0 depends on: ii libasound2 1.0.23-3 shared library for ALSA applicatio ii libatk1.0-0 2.0.0-1 The ATK accessibility toolkit ii libbz2-1.0 1.0.5-6 high-quality block-sorting file co ii libc6 2.11.2-13 Embedded GNU C Library: Shared lib ii libcairo2 1.10.2-6 The Cairo 2D vector graphics libra ii libdbus-1-3 1.4.8-2 simple interprocess messaging syst ii libevent-1.4-2 1.4.13-stable-1 An asynchronous event notification ii libfontconfig1 2.8.0-2.2 generic font configuration library ii libfreetype6 2.4.4-1 FreeType 2 font engine, shared lib ii libgcc1 1:4.6.0-4 GCC support library ii libglib2.0-0 2.28.6-1 The GLib library of C routines ii libgtk2.0-0 2.24.4-3 The GTK+ graphical user interface ii libhunspell-1.2- 1.2.14-4 spell checker and morphological an ii libjpeg62 6b1-1 The Independent JPEG Group's JPEG ii libmozjs4d 2.0-3 The Mozilla SpiderMonkey JavaScrip ii libnspr4-0d 4.8.7-2 NetScape Portable Runtime Library ii libnss3-1d 3.12.9.with.ckbi.1.82-1 Network Security Service libraries ii libpango1.0-0 1.28.3-6 Layout and rendering of internatio ii libpixman-1-0 0.21.6-2 pixel-manipulation library for X a ii libreadline6 6.1-3 GNU readline and history libraries ii libsqlite3-0 3.7.5-1 SQLite 3 shared library ii libstartup-notif 0.10-1 library for program launch feedbac ii libstdc++6 4.6.0-4 The GNU Standard C++ Library v3 ii libvpx0 0.9.6-1 VP8 video codec (shared library) ii libx11-6 2:1.4.3-1 X11 client-side library ii libxext6 2:1.2.0-2 X11 miscellaneous extension librar ii libxrender1 1:0.9.6-1 X Rendering Extension client libra ii libxt6 1:1.1.1-1 X11 toolkit intrinsics library ii zlib1g 1:1.2.3.4.dfsg-3 compression library - runtime Versions of packages xulrunner-2.0 suggests: ii libcanberra0 0.24-1 a simple abstract interface for pl ii libdbus-glib-1-2 0.92-1 simple interprocess messaging syst ii libgconf2-4 2.28.1-6 GNOME configuration database syste ii libgnomeui-0 2.24.3-1 The GNOME libraries (User Interfac ii libgnomevfs2-0 1:2.24.4-1 GNOME Virtual File System (runtime ii libnotify1 [libnotify1-gtk2.1 0.5.0-2 sends desktop notifications to a n - -- no debconf information iEYEARECAAYFAk2yb8AACgkQKFvXofIqeU5adACfbAED2cq0njmSnvZoFZNDxLmM 7toAn3xfkMu8pZZ9bxlQql3QbB2E4yBD =IsRh -----END PGP SIGNATURE-----