Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I have recently encountered the following issue: a user couldn't access a website that was using an intermediate VeriSign certificate because it is no longer included in Firefox.

Some sources claim that Firefox will import the certificate from websites that send it, others say that it won't.

Will it? If not, is it supposed to?

share|improve this question
add comment

1 Answer 1

up vote 2 down vote accepted

Firefox is supposed to, and does, import intermediate certificates that are provided by the web server it's currently talking to. It won't go out and find them for itself. Most likely the website in question has omitted to install the correct certificate chain.

share|improve this answer
    
Note that other Firefox installations may be able to load the same website with no warning message, because if that Firefox install has loaded the correct intermediate certificate from a different website, it will keep it for future reuse. –  Mike Scott Mar 12 '11 at 12:32
    
@Mike thanks, would it be reasonable for me to request (via Bugzilla) that Firefox says something like "intermediate certificate not supplied" instead of just "untrusted issuer" for the case where the website didn't send it? –  romkyns Mar 12 '11 at 12:32
    
tinyurl.com/6l34o5d is a check for the website in question - which suggests the website does everything fine. tinyurl.com/6jkvh78 is a thread where others seem to have the same issue - the website sends it but FF doesn't import it. –  romkyns Mar 12 '11 at 12:35
1  
@romkyns I think the SSL checker that you're using also has the Verisign intermediate certificate pre-installed. Try this one: knowledge.geotrust.com/support/knowledge-base/… –  Mike Scott Mar 12 '11 at 12:52
1  
@Mike I see, so there's nothing that can be done to distinguish a misconfigured website from a compromised one. That sucks :/ –  romkyns Mar 12 '11 at 15:13
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.