We're calling on all EU-based Mozillians with iOS or iPadOS devices to help us monitor Apple’s new browser choice screens. Join the effort to hold Big Tech to account!

Avatar for Username

Cari Bantuan

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Pelajari Lebih Lanjut

Utas ini telah diarsipkan. Silakan membuat pertanyaan baru jika Anda membutuhkan bantuan.

Intermediate certification authorities chain fails

  • 4 balas
  • 16 memiliki masalah ini
  • 2 kunjungan
  • Balasan terakhir oleh tosiara

tosiara
tosiara
more options

After importing RootCA FireFox still can not load a web page signed by intermediate certification authorities.

Root CA certificate: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/971D3486FC1E8E6315F7C6F2E12967C724342214.crt

Web Site: https://id.rcsc.lt/

Certificate Chain should look like:

RootCa 

PolicyCA
  IssuingCA
    id.rcsc.lt


I have tried IE and Opera and both working fine and detecting certificate chain. Only need to import RootCA cert to establish trust

Why FireFox does not work as expected?

After importing RootCA FireFox still can not load a web page signed by intermediate certification authorities. Root CA certificate: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/971D3486FC1E8E6315F7C6F2E12967C724342214.crt Web Site: https://id.rcsc.lt/ Certificate Chain should look like: RootCa PolicyCA IssuingCA id.rcsc.lt I have tried IE and Opera and both working fine and detecting certificate chain. Only need to import RootCA cert to establish trust Why FireFox does not work as expected?

Semua Balasan (4)

cor-el
cor-el
  • Moderator
  • Top 10 Contributor
more options

A web server needs to send the full chain of intermediate certificates.
Importing the root certificate is not enough.
If the server doesn't send the certificate then you need to install (import) that intermediate certificate as well.

tosiara
tosiara Pemilik pertanyaan
more options

So how then IE and Opera receive full certificate chain? And why FireFox does not receive it?

tosiara
tosiara Pemilik pertanyaan
more options

I think I got why IE and Opera works fine

Inside IssuingCA certificate there is a link to upper CA certificate:

[Authority Information Access] OCSP: URI: http://ocsp.rcsc.lt/ocspresponder.rcsc CA Issuers: URI: http://csp.rcsc.lt/aia/VI%20Registru%20Centras%20RCSC%20(PolicyCA)(2).crt

IE and Opera retrieve PolicyCA certificate and then the same way retrieve RootCA certificate. That how they verify trust

The question remains: why FireFox can't do the same?

tosiara
tosiara Pemilik pertanyaan
more options

Still same in FF5