Open Bug 1557934 Opened 5 years ago Updated 2 years ago

certificate manager misleads users into thinking they can delete built-in roots

Categories

(Core :: Security: PSM, defect, P3)

66 Branch
defect

Tracking

()

Tracking Status
firefox67 --- affected
firefox68 --- affected
firefox69 --- affected

People

(Reporter: php4fan, Unassigned)

References

(Blocks 1 open bug)

Details

(Whiteboard: [psm-backlog])

Attachments

(1 file)

Hi,

I couldn't reproduce with expired certifiate because I don't have one, but instead I reproduced with active certificate.

Steps to reproduce:

  1. Go to Settings, search for "certificates", click "view certificates"
  2. Make sure the tab "Authorities" is selected
  3. Select an active certificate
  4. Click "Delete" button
  5. Confirm -> Note that certificate is not displayed in the list.
  6. Open a website (gmail)
  7. Go back to Settings > View Certificates > "Authorities" tab

Actual results:
Deleted certificate is displayed in the list

Expected results:
Certificate should be deleted.

Status: UNCONFIRMED → NEW
Component: Untriaged → Security: PSM
Ever confirmed: true
Product: Firefox → Core

Hello,

Are you sure the certificate that you are deleting is one that can actually be deleted?

In my case I'm talking about user certificates (i.e. Your Certificates), which of course one should be able to delete.

I remember a different bug about Authority certificates that you are not supposed to be able to delete. In that case, the issue was that the interface would allow you to delete them, and they would disappear from the list as you describe, while the expected behavior would be an error message or not having the option to delete in the first place.

I ask just to make sure that you are not observing that issue which is a different one.

For built-in roots, you need to edit the trust and remove the trust bits rather than delete them, as they aren't actually stored in the database (and aren't thus delectable). The UX is not great and deserves attention.

Blocks: 1029832
Priority: -- → P3
Summary: Can't delete expired certificate → certificate manager misleads users into thinking they can delete built-in roots
Whiteboard: [psm-backlog]
Severity: normal → S3
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: