1

I have recently encountered the following issue: a user couldn't access a website that was using an intermediate VeriSign certificate because it is no longer included in Firefox.

Some sources claim that Firefox will import the certificate from websites that send it, others say that it won't.

Will it? If not, is it supposed to?

Improve this question

1 Answer 1

Reset to default
2

Firefox is supposed to, and does, import intermediate certificates that are provided by the web server it's currently talking to. It won't go out and find them for itself. Most likely the website in question has omitted to install the correct certificate chain.

Improve this answer
6
  • Note that other Firefox installations may be able to load the same website with no warning message, because if that Firefox install has loaded the correct intermediate certificate from a different website, it will keep it for future reuse.
    – Mike Scott
    Mar 12, 2011 at 12:32
  • @Mike thanks, would it be reasonable for me to request (via Bugzilla) that Firefox says something like "intermediate certificate not supplied" instead of just "untrusted issuer" for the case where the website didn't send it?
    – RomanSt
    Mar 12, 2011 at 12:32
  • tinyurl.com/6l34o5d is a check for the website in question - which suggests the website does everything fine. tinyurl.com/6jkvh78 is a thread where others seem to have the same issue - the website sends it but FF doesn't import it.
    – RomanSt
    Mar 12, 2011 at 12:35
  • 1
    @romkyns I think the SSL checker that you're using also has the Verisign intermediate certificate pre-installed. Try this one: knowledge.geotrust.com/support/knowledge-base/…
    – Mike Scott
    Mar 12, 2011 at 12:52
  • 1
    @Mike I see, so there's nothing that can be done to distinguish a misconfigured website from a compromised one. That sucks :/
    – RomanSt
    Mar 12, 2011 at 15:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.