Bug 501610

Summary:	Firefox 3.5 beta and issues with CRLs
Product:	[Fedora] Fedora	Reporter:	James Ralston <ralston>
Component:	firefox	Assignee:	Gecko Maintainer <gecko-bugs-nobody>
Status:	CLOSED NOTABUG	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	high	Docs Contact:
Priority:	high
Version:	rawhide	CC:	gecko-bugs-nobody, mcepl, walters
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2009-05-23 20:26:20 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description James Ralston 2009-05-20 02:25:44 UTC

Firefox 3.5 beta does not appear to be able to connect to sites that use EV SSL certificates.

E.g., when attempting to connect to <https://www.chase.com/>:

Secure Connection Failed

An error occurred during a connection to www.chase.com.

New CRL has an invalid format.

(Error code: sec_error_crl_invalid)

This is a severe problem, as many sites now use EV SSL certificates.

Versions:

0:firefox-3.5-0.20.beta4.fc11.x86_64

Comment 1 James Ralston 2009-05-23 02:24:27 UTC

After doing some more digging, I found this:

http://www.nzgeek.net/blog/post/2009/03/12/Firefox-and-sec_error_crl_invalid-errors.aspx

Although neither of the two CRLs I had installed appeared to be invalid as per the description in the above blog post, I refreshed the CRLs, and now I no longer get the "New CRL has an invalid format" error.

The strange thing is, though, I rsync my ~/.mozilla directory between my Fedora 11 Preview box and my Fedora 10 box, so both Firefox 3.0 and Firefox 3.5 beta were using the exact same data, and Firefox 3.0 never issued any invalid CRL errors.

I have a copy of my ~/mozilla directory in the state where Firefox 3.5 beta complains about invalid CRLs. If you want to see the specific CRLs that Firefox was complaining about, please tell me how to extract that data. Otherwise, feel free to close this bug as INVALID.

Comment 2 Matěj Cepl 2009-05-23 20:26:20 UTC

I wouldn't say invalid, but I cannot reproduce just by going to the Chase website. I would need to set up CRL management somehow.

So, closing this as NOTABUG, but if you think there is something to be resolved, please, describe in detail how to reproduce this bug on our system.

Thank you very much for filing this bug and investigating it further (that is rare).