[Regression] Cacert CA certified certificate no longer recognized

[Rolf Leggewie]

There is a fairly serious regression from thunderbird 15.0.1+build1-0ubuntu0.10.04.1 to 1:16.0.1+build1-0ubuntu0.10.04.1. The later version apparently no longer recognizes the Cacert CA whereas the former does. I use a self-signed cert for my mail-server with a key that is trusted by Cacert.org. This stopped working today with said update. Upon connection to the mail server I'm being shown an "Add security exception"-dialog saying that the certificicate isn't trusted. I have run TB in safe-mode and it was the same. I've also tried adding the Cacert root CA explicitly as trusted but TB told me that the certificate is already in the pool (not really a surprise as the old version of TB relied on it quite happily). I've now downgraded back to the previous version and used pinning to prevent an upgrade.

Oh, and by the way, feel free to ignore this ticket as I believe in "Datensparsamkeit" instead of routinely uploading oodles of private information via apport. This ticket contains all the information you need, if not, feel free to ask for clarification. I hope Ubuntu is still about quality and not about being required to use certain tools to report an issue (while being ignored in the bug tracker nonetheless ;))

[Jonathan Watt (jwatt)]

I just updated to 16.0.1 and on restart I keep getting the dialog:

  You are about to override how Thunderbird identifies this site.
  ...
  blah, blah
  ...
  Confirm Security Exception

every time TB tries to fetch my mail using POP from sub3.homie.mail.dreamhost.com:955 over SSL/TLS.

I've uninstalled and reinstalled the Dreamhost cert authority, making sure to allow it to identify sites and mail users:

http://wiki.dreamhost.com/NDN_Certificate

But still the mail server cert (which appears to originate with that cert authority cert) is not accepted by TB.

[Miquel Martin (bugzilla-miquelmartin)]

Works fine on 15.0.1. Testing 16.0.1...

[Miquel Martin (bugzilla-miquelmartin)]

I installed 16.0.1 on linux on a test user (so I didn't update, I directly installed) and configured my dreamhost account. I had to confirm the security exception once, but otherwise setting up the account was done actually with email address and password alone. I haven't seen the error you describe using IMAP. I have it all set up. Is there anything else I can test for you guys?

[Jonathan Watt (jwatt)]

Hi Miquel. It's not IMAP, but rather POP3 that I have a problems with. (Actually, IMAP may be a problem too, but I haven't got as far as trying that just yet.)

Regarding your testing, yes, after accepting the certificate in 16.0.1 you won't be prompted to again. The issue is that you shouldn't be prompted to accept it at all.

Can you try this:

Delete your Thunderbird profile and delete Thunderbird 16.0.1. Install 15.0.1 instead, and install the certificate authority cert as detailed on the wiki page linked to in comment 0. Now create your test email account in Thunderbird and try to check your mail over POP3 with SSL/TLS. Do you get prompted now? If so, accept the certificate. Next, update to 16.0.1 and try checking your email again. Do you get prompted now?

[Jonathan Watt (jwatt)]

To be clear, what is primarily of interest here is whether a cert that is installed and accepted in a Thunderbird profile in 15 stops being accepted when you install 16 and use it with that same TB account.

[Bsmith-mozilla (bsmith-mozilla)]

From http://wiki.dreamhost.com/NDN_Certificate:

"Not quite standards compliant

Now, however some astute readers have alerted me to the fact that this new certificate isn’t actually X.509 specification compliant. We’re going to stick with it, since it does help a subset of our users, and will consider some alternatives for the future!"

[Ludovic-mozilla (ludovic-mozilla)]

Jwatt could you try with a new profile ?

[Miquel Martin (bugzilla-miquelmartin)]

Hi,
This is not happening to me when upgrading a functional imaps config with dreamhost from Thunderbird 15.0.1 to 16.0.1 with OSX 10.8.2

[Bugzilla-mozilla-org-rolf (bugzilla-mozilla-org-rolf)]

I wonder if this isn't the same that I reported as https://bugs.launchpad.net/thunderbird/+bug/1066585 Sounds a lot like it, 15 worked fine and 16 drops the ball.

[Jrn (jrn)]

Happening here; the issue is not that I can't work around it with a security exception, but that it should not require a security exception. The remote server is presenting a valid certificate signed by a CA certificate I have installed, there is no security exception to be made. I'm certainly not about to start adding invalid security exceptions!

Have downgraded to 15 to work-around for now.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Ludovic-mozilla (ludovic-mozilla)]

Can someone chase the regression window for those of you who have and see the issue ?

[Miquel Martin (bugzilla-miquelmartin)]

Created attachment 672204
The certificate confirmation I get

[Miquel Martin (bugzilla-miquelmartin)]

Created attachment 672205
The certificate for which confirmation is requested

[Miquel Martin (bugzilla-miquelmartin)]

I've added screenshots of the confirmation requests I get for the dreamhost certificate. I _do not know_ if this is the problem you are all referring to.

My domain name is mail.miquelmartin.org and I'm using the default SSL support from dreamhost, which means the certificate I get from them has a CN of *.mail.dreamhost.com.

Naturally, mail.miquelmartin.org is not included in *.mail.dreamhost.com, so I rightfully get a "Wrong Site" warning which I have to confirm.

This is _not_ a bug, though. Maybe I'm looking at the wrong stuff.

[Bugzillamozilla (bugzillamozilla)]

*.mail.dreamhost.com has md5 as signature algorithm. Maybe OP got hit by https://bugzilla.mozilla.org/show_bug.cgi?id=650355 ?

[Slawicki (slawicki)]

After change from md5 to sha1 as signature algorithm in my CA certificate, the TB problems with certificates signed by my CA has gone.

[Ludovic-mozilla (ludovic-mozilla)]

Jwatt does it solve it for you too ?

[Chris Coulson (chrisccoulson)]

Please do not assign bugs to me without asking me first. It implies that you've made a decision for me on how I should prioritize a task, and you have no idea of what my current workload is. This is incredibly rude

Anyway, does this work with security.enable_md5_signatures set to true?

[Rolf Leggewie (r0lf)]

Chris, I assigned this to you since you uploaded the regression. That seems fair to me. Under other circumstances I would not assign a ticket.

Upstream bug tracker talks about security.enable_md5_signatures but it seems this is a Firefox setting, not one for TB.

[Chris Coulson (chrisccoulson)]

Whether it was me who uploaded the package or not is irrelevant.

And the setting is applicable to both Firefox and Thunderbird

[Bugzilla-mozilla-org-rolf (bugzilla-mozilla-org-rolf)]

How do I check and change the signature algorithm for an existing certificate?

[Bugzillamozilla (bugzillamozilla)]

You can't. CA should reissue certificate with sha1 instead of md5.

[Bugzilla-mozilla-org-rolf (bugzilla-mozilla-org-rolf)]

#18, thank you for your comment. The first step would be to verify that indeed certificate X uses md5, no? How did you do this in comment #14?

[Bsmith-mozilla (bsmith-mozilla)]

(In reply to Rolf Leggewie from comment #19)
> #18, thank you for your comment. The first step would be to verify that
> indeed certificate X uses md5, no? How did you do this in comment #14?

See bug 802699 comment 2 (https://bugzilla.mozilla.org/show_bug.cgi?id=802699#c2) for the step-by-step instructions for how to do this. Let me know if you have trouble.

[Bugzillamozilla (bugzillamozilla)]

bsmith said how you can verify if certificate uses md5 or sha1. Change to sha1 should do the trick and the problem will be solved.

[Rolf Leggewie (r0lf)]

"Whether it was me who uploaded the package or not is irrelevant." I see. So, Ubuntu is now at the point where you no longer have to take responsibility if you screw things up? Great! Just great! Way to go.

[Rolf Leggewie (r0lf)]

In all of the FOSS projects that I was involved with so far a good principle being adhered to was "you break it, you fix it"

[Bugzilla-mozilla-org-rolf (bugzilla-mozilla-org-rolf)]

I am still affected by this problem in TB17 and going by #20 the certificate I use is not md5: PKCS #1 SHA-1 With RSA Encryption

Ludovic, how can I provide the information you were requesting?

[Micah Gersten (micahg)]

Rolf, let's keep things calm here. Mozilla's rapid release schedule introduces the possibility of more frequent regressions. We try to the extent possible to test for common scenarios that might impact a normal workflow. Obviously we can't catch everything. Even though Chris did the upload here, we're basically forced to keep up with the rapid release cycle. I tested and released the upload after verifying basic mail functionality. He didn't say he's not open to helping and did ask a question that was just answered upstream 2 months after he asked it here. So, please, stay calm.

[Rolf Leggewie (r0lf)]

Micah, thanks for stepping in. No worry, I am perfectly calm. And I am not trying to blame anyone for the work they do, it's much appreciated. I am certainly aware that Mozilla is a huge project and that there is always a big possibility of regressions slipping through (which in fact is why I pin TB and FF until a time when I can accept a breakage should it occur).

What I do not appreciate is the lack of sense of responsibility for one's own actions that seemed to be apparent here - especially if from a paid developer. The comment I quoted half an hour ago is unacceptable IMHO.

[Micah Gersten (micahg)]

He didn't "not take responsibility" per se. He asked that he not be assigned tasks without a consult and asked a question in an attempt to help you debug your issue. I believe that's perfectly reasonable. He didn't get a response for two months, and when one was posted, that response was that he didn't take responsibility. I find that ironic. Let's drop this discussion and resume the debugging which you seem to be doing with upstream now.

[Rolf Leggewie (r0lf)]

The response of essentially "I don't know where to change this setting so as to apply to TB" was given on the same day the question was asked. That answer hasn't changed.

[Micah Gersten (micahg)]

No, he said the setting is the same in TB and I verified last night he was correct.

[Rolf Leggewie (r0lf)]

Micah, please read #32 again. I think you misunderstood me. I was talking about myself, not Chris. And I still would not know how to change the setting in TB (or verify the current setting). In any case, that's not relevant because as I found out my certificate does not use md5.

[Frank Lanitz (frlan)]

Is there any update avaialble here besinde of talking about who might and might not did any wrong? It's really annoying to to have a chance to trust a cacert cert with a fresh profile.

[Ludovic-mozilla (ludovic-mozilla)]

(In reply to Rolf Leggewie from comment #22)
> I am still affected by this problem in TB17 and going by #20 the certificate
> I use is not md5: PKCS #1 SHA-1 With RSA Encryption
>
> Ludovic, how can I provide the information you were requesting?

for thr regression window see http://www.rumblingedge.com/2009/02/24/howto-find-regression-windows-through-manual-binary-search/

sorry for the delay the email got lost somehow.

[Frank Lanitz (frlan)]

What inforamtio are you needing?

[gf (gf-interlinks-deactivatedaccount)]

Hello Rolf
Thank you for submitting this bug and reporting a problem with Thunderbird.

You made this bug report in 2012 and there have been several versions of Ubuntu and Thunderbird since then.

Could you confirm that this is no longer a problem and that we can close the ticket?
Or, if it is still a problem, could you run the following (only once):
apport-collect BUGNUMBER

and upload the updated logs and and any other logs that are relevant for this particular issue.

Thank you again for helping make Ubuntu and Thunderbird better.

G

[Paul White (paulw2u)]

Bug did not expire due to bug watch
Upstream issue showing "RESOLVED WORKSFORME" on 2017-07-21
Reporter said upstream "secure communication has been working fine"
No comments here for six years so closing