[Bug 310999] Re: comodo seen issuing certificates unwisely
** Changed in: nss Status: In Progress = Fix Released -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/310999 Title: comodo seen issuing certificates unwisely To manage notifications about this bug go to: https://bugs.launchpad.net/nss/+bug/310999/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 310999] Re: comodo seen issuing certificates unwisely
I am seeing the This connection is untrusted warnings in Firefox 3.6.12 on Ubuntu 10.10 for sites with certificates from Comodo. The same sites work fine in Firefox 3.6.x on Windows XP. Sites include: https://contractor.lexisnexis.com/CS/welcome.do?justanswer http://wingsguate.org/civicrm/contribute/transact?reset=1id=1 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/310999 Title: comodo seen issuing certificates unwisely -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 310999] Re: comodo seen issuing certificates unwisely
** Changed in: nss Importance: Unknown = High -- comodo seen issuing certificates unwisely https://bugs.launchpad.net/bugs/310999 You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 310999] Re: comodo seen issuing certificates unwisely
** Changed in: nss Status: Confirmed = In Progress -- comodo seen issuing certificates unwisely https://bugs.launchpad.net/bugs/310999 You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 310999] Re: comodo seen issuing certificates unwisely
Alexander confirms that no action is required from our side any more. ** Changed in: nss (Ubuntu Jaunty) Status: Triaged = Won't Fix ** Changed in: nss (Ubuntu Intrepid) Status: Triaged = Won't Fix ** Changed in: nss (Ubuntu Hardy) Status: Triaged = Won't Fix ** Changed in: nss (Ubuntu Gutsy) Status: Triaged = Won't Fix ** Changed in: nss (Ubuntu Dapper) Status: Triaged = Won't Fix ** Changed in: nss (Ubuntu) Status: Triaged = Won't Fix ** Changed in: nss (Ubuntu Jaunty) Assignee: Alexander Sack (asac) = (unassigned) -- comodo seen issuing certificates unwisely https://bugs.launchpad.net/bugs/310999 You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 310999] Re: comodo seen issuing certificates unwisely
** Changed in: nss (Ubuntu Jaunty) Assignee: (unassigned) = Alexander Sack (asac) ** Changed in: ca-certificates (Ubuntu Jaunty) Assignee: (unassigned) = Alexander Sack (asac) -- comodo seen issuing certificates unwisely https://bugs.launchpad.net/bugs/310999 You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 310999] Re: comodo seen issuing certificates unwisely
Information on mozilla mailing lists indicates that Comodo has followed up on the improperly issued certificates, and that revocations of the affected certificates have been published in a crl: http://www.mail- archive.com/dev-tech-cry...@lists.mozilla.org/msg05818.html So I don't see that there's any action that should be taken here on the ca-certificates package. ** Changed in: ca-certificates (Ubuntu Jaunty) Target: jaunty-alpha-4 = None ** Changed in: ca-certificates (Ubuntu Jaunty) Status: Triaged = Invalid ** Changed in: ca-certificates (Ubuntu Intrepid) Status: Triaged = Invalid ** Changed in: ca-certificates (Ubuntu Hardy) Status: Triaged = Invalid ** Changed in: ca-certificates (Ubuntu Gutsy) Status: Triaged = Invalid ** Changed in: ca-certificates (Ubuntu Dapper) Status: Triaged = Invalid -- comodo seen issuing certificates unwisely https://bugs.launchpad.net/bugs/310999 You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
Re: [Bug 310999] Re: comodo seen issuing certificates unwisely
On Fri, Jan 16, 2009 at 01:54:17AM -, Steve Langasek wrote: Still in a holding pattern here, not blocking alpha-3 on this. Do we think we can get a resolution for alpha-4? ** Changed in: ca-certificates (Ubuntu Jaunty) Target: jaunty-alpha-3 = jaunty-alpha-4 Upstream still thinking as it seems. - Alexander -- comodo seen issuing certificates unwisely https://bugs.launchpad.net/bugs/310999 You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 310999] Re: comodo seen issuing certificates unwisely
Still in a holding pattern here, not blocking alpha-3 on this. Do we think we can get a resolution for alpha-4? ** Changed in: ca-certificates (Ubuntu Jaunty) Target: jaunty-alpha-3 = jaunty-alpha-4 -- comodo seen issuing certificates unwisely https://bugs.launchpad.net/bugs/310999 You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 310999] Re: comodo seen issuing certificates unwisely
Regarding ca-certificates, while this problem is unfortunate, it is clear that simply removing the cert is not the answer because thousands of perfectly valid certificates would be marked invalid. If a subset of Comodo is to be invalidated, we need to consider Mozilla's rationale and implementation. -- comodo seen issuing certificates unwisely https://bugs.launchpad.net/bugs/310999 You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
Re: [Bug 310999] Re: comodo seen issuing certificates unwisely
On Tue, Jan 06, 2009 at 01:58:37PM -, Jamie Strandboge wrote: Regarding ca-certificates, while this problem is unfortunate, it is clear that simply removing the cert is not the answer because thousands of perfectly valid certificates would be marked invalid. If a subset of Comodo is to be invalidated, we need to consider Mozilla's rationale and implementation. OK, so lets wait for both nss and ca-certificates and see what mozilla comes up with. - Alexander -- comodo seen issuing certificates unwisely https://bugs.launchpad.net/bugs/310999 You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 310999] Re: comodo seen issuing certificates unwisely
i will defer decision for the ca-certificates package to the ubuntu security team. If they make a decision i will also communicate their rational to NSS upstream. ** Changed in: ca-certificates (Ubuntu) Importance: Undecided = High Status: New = Triaged -- comodo seen issuing certificates unwisely https://bugs.launchpad.net/bugs/310999 You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 310999] Re: comodo seen issuing certificates unwisely
blocking next alpha so we get a decision soon. ** Changed in: ca-certificates (Ubuntu Jaunty) Target: None = jaunty-alpha-4 ** Changed in: ca-certificates (Ubuntu Jaunty) Target: jaunty-alpha-4 = jaunty-alpha-3 -- comodo seen issuing certificates unwisely https://bugs.launchpad.net/bugs/310999 You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 310999] Re: comodo seen issuing certificates unwisely
we should decide on the blocking status for stable ubuntu releases, once we decided what to do for jaunty. ** Changed in: ca-certificates (Ubuntu Dapper) Importance: Undecided = High Status: New = Triaged ** Changed in: ca-certificates (Ubuntu Gutsy) Importance: Undecided = High Status: New = Triaged ** Changed in: ca-certificates (Ubuntu Hardy) Importance: Undecided = High Status: New = Triaged ** Changed in: ca-certificates (Ubuntu Intrepid) Importance: Undecided = High Status: New = Triaged ** Changed in: nss (Ubuntu Dapper) Importance: Undecided = High Status: New = Triaged ** Changed in: nss (Ubuntu Gutsy) Importance: Undecided = High Status: New = Triaged ** Changed in: nss (Ubuntu Hardy) Importance: Undecided = High Status: New = Triaged ** Changed in: nss (Ubuntu Intrepid) Importance: Undecided = High Status: New = Triaged -- comodo seen issuing certificates unwisely https://bugs.launchpad.net/bugs/310999 You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 310999] Re: comodo seen issuing certificates unwisely
i will follow upstream decision on nss package. ** Changed in: nss (Ubuntu) Importance: Undecided = High Status: New = Triaged -- comodo seen issuing certificates unwisely https://bugs.launchpad.net/bugs/310999 You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
Re: [Bug 310999] Re: comodo seen issuing certificates unwisely
On Fri, Jan 02, 2009 at 02:32:54PM -, Gabriel de Perthuis wrote: DIY way to quit trusting these certificates: sudo sed -ri '/comodo|utn|addtrust/Is/^!*/!/' /etc/ca-certificates.conf; sudo update-ca-certificates nss doesnt use the ca-certificates package, but uses its own cert store ... - Alexander ** Also affects: nss (Ubuntu) Importance: Undecided Status: New -- comodo seen issuing certificates unwisely https://bugs.launchpad.net/bugs/310999 You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 310999] Re: comodo seen issuing certificates unwisely
DIY way to quit trusting these certificates: sudo sed -ri '/comodo|utn|addtrust/Is/^!*/!/' /etc/ca-certificates.conf; sudo update-ca-certificates -- comodo seen issuing certificates unwisely https://bugs.launchpad.net/bugs/310999 You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 310999] Re: comodo seen issuing certificates unwisely
Ubuntu has the opportunity to exercise some editorial judgment here by removing the cert regardless of the Mozilla project's decision. This cert authority has clearly breached their duty to users to issue certs only to verified parties. Since these certs are installed system-wide, and are used by many programs other than Mozilla products, Ubuntu should reach an independent decision. -- comodo seen issuing certificates unwisely https://bugs.launchpad.net/bugs/310999 You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 310999] Re: comodo seen issuing certificates unwisely
Well, I would like to defer to Mozilla's judgement here, as it comes from their truststore. On the other hand we do not have the possibility, to my knowledge, to add an intermediate CA to the package with some negative trust value. So we would need to prune Comodo completely. As stated CertStar is a contracted RA of Comodo, so they have their own domain validation in place, in constrast to normal resellers. I also see the problem that we would cut off thousands of valid certificates, those which were issued by Comodo instead of, say, PositiveSSL (if this is the RA CertStar operates). ** Bug watch added: Mozilla Bugzilla #470897 https://bugzilla.mozilla.org/show_bug.cgi?id=470897 ** Also affects: nss via https://bugzilla.mozilla.org/show_bug.cgi?id=470897 Importance: Unknown Status: Unknown -- comodo seen issuing certificates unwisely https://bugs.launchpad.net/bugs/310999 You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 310999] Re: comodo seen issuing certificates unwisely
** Changed in: nss Status: Unknown = Confirmed -- comodo seen issuing certificates unwisely https://bugs.launchpad.net/bugs/310999 You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 310999] Re: comodo seen issuing certificates unwisely
** Summary changed: - comodo seen issuing CAs unwisely + comodo seen issuing certificates unwisely -- comodo seen issuing certificates unwisely https://bugs.launchpad.net/bugs/310999 You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
