1120350 - Firefox unable to use client certificates in Windows certificate store

Status: RESOLVED DUPLICATE of bug 1586915

(Core :: Security: PSM, defect, P3)

Description

[[e-mail]]

User Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; Touch; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; Tablet PC 2.0; InfoPath.3; rv:11.0) like Gecko

Steps to reproduce:

Client certificate is mandated by some applications during TLS client challenge. Microsoft IE and Google Chrome browsers use MS CNG API to use the client certificate in windows store. However, Firefox has a certificate store of its own, and does not recognize the client certificate(s) in windows store. 

Try connecting to any web application that challenges for client certificate authentication from Firefox browser.  Firefox simply fails to respond to TLS client auth challenge.




Actual results:

Firefox users are unable to connect with web apps that challenge the browser for TLS client auth. The same web app can be accessed from Microsoft IE, and Google Chrome browsers. It would be great if users can have the same seamless application access experience, no matter which browser they use.


Expected results:

Firefox browser on Windows is unable to connect with applications demanding TLS client authentication, as Firefox does not recognize client certificates in Windows store. When a plugin that imports clients certs from Windows store is available, Firefox on Windows will be able to respond to TLS client authentication challenge, and allow users to connect with apps demanding TLS client auth.

An NSSCAPI plugin module that imports client certificates to Firefox, using Microsoft CNGAPI will fix the issue.

Comment 1

[:Gijs (he/him)]

Pretty sure this is a PSM/NSS issue, not a CA cert policy one. I also would have sworn we had this on file already. Brian, do you know more?

Comment 2

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

It's pretty obvious to me that Firefox should use the windows certificate store for finding the user's *client* certificates instead of using NSS's certificate store. However, I also expect that nobody will want to work on this any time soon. So, a motivated contributor would probably have to do all the work.

Comment 3

[vladimir.finkinshtein]

Hi guys,

Is there a workaround for this scenario, for example to install some Security Modules and Devices in order to specify Firefox to use Windows certificate store.

Thanks in advance,
Vladimir

Comment 5

[H Chalasani]

Hi, can someone please give an update on this.

Comment 6

[Dana Keeler (she/her) [:keeler]]

There is no update - we are not currently working on this.

Comment 7

[H Chalasani]

(In reply to David Keeler [:keeler] (use needinfo) from comment #6)
> There is no update - we are not currently working on this.

Thanks.

Comment 8

[mozilla-firefox]

Hi David, you or someone in the Mozilla org should work on this, if you are ever interested in firefox being used in an enterprise. This makes it impossible for the ~50k employees in my company to use firefox for our intranet site.  https://www.mozilla.org/en-US/firefox/enterprise/

Best regards

Moritz

Comment 9

[David Ward]

(In reply to [e-mail] from comment #0)
> An NSSCAPI plugin module that imports client certificates to Firefox, using
> Microsoft CNGAPI will fix the issue.

A CAPI module was added in-tree in 2005: https://dxr.mozilla.org/mozilla-central/source/security/nss/lib/ckfw/capi/)

However it has not been modified since then, and it was later disabled in Firefox builds: https://hg.mozilla.org/projects/nss/rev/e744d78d0dcc


Can anyone speak to what is currently missing or broken in the CAPI module that would allow it to be used even experimentally in test builds? I found a 10-year-old thread (https://groups.google.com/forum/#!topic/mozilla.dev.tech.crypto/aL7UHhmF454), but otherwise I can't seem to find anywhere that is tracking this.

Comment 10

[Dana Keeler (she/her) [:keeler]]

I wasn't aware that existed. I am not familiar with its capabilities.

Comment 11

[Robert Relyea]

When it was written, it could access user certificates in the Microsoft database. It does not see root certificates. It hasn't been maintained in quite some time, so I don't know if it has bit-rotted. If you want to supply that capability, it might be a good place to start. The code worked, but was not extensively tested, so there could be issues.

bob

Comment 13

[stian]

Hello, I also want to underpin the importance of this. This lacking functionality makes Firefox unusable for my work as we use certificates to authenticate to many services internally. Hope this bug could get some attention :)

Comment 14

[[e-mail]]

I registered specifically to stress what stian said. This feature is imperative IMHO if Firefox ever should be used in big enterprises. Because of this 4 year old issue, Firefox is unusable in my company. I would appreciate a lot if someone was assigned to look into this issue! I'm also willing to assist in any way I can.

Comment 16

[pdeak]

Just another company chiming in - we can't support any staff trying to use Firefox, due to the fact that it uses it's own certificate store. Firefox would need to make use of the system certificate store as it's source of client certificates, the same way as Internet Explorer, Edge, Google Chrome does.

Comment 17

[Dana Keeler (she/her) [:keeler]]

I had a look at the CAPI module. It does build, but it uses the old Windows crypto API. As a result, it doesn't support modern algorithms like SHA-256 and doesn't work with TLS 1.2 or 1.3. It would have to be updated to CNG (the new crypto API).

Comment 18

[ckimes89]

I work at Microsoft and am experiencing this issue. I would be happy to test any fixes or perform any troubleshooting necessary to help get this resolved.

Comment 19

[Mike Kaply [:mkaply]]

Does setting the preference:

security.enterprise_roots.enabled

help any with regards to this?

We did some Window cert work here:

https://bugzilla.mozilla.org/show_bug.cgi?id=1265113

for enterprise roots.

Comment 20

[Dana Keeler (she/her) [:keeler]]

Unfortunately, no. Supporting client certificates provided by native (OS) APIs would be much more work.

Comment 24

[Franz]

Would appreciate this feature too, because Enterprise certificate based applications do not work with Firefox, but with Chrome.
I'd like to keep Chrome outside the company....

Comment 25

[Jestre]

FYI, My company just auto uninstalled & blocked Firefox and Thunderbird from all corporate assets.
Not honoring the system certificate store was the reason.
This will start to cause a larger decrease in installs & usage as this propagates.
Had to send this from chrome!

Comment 26

[Mike Kaply [:mkaply]]

(In reply to Jestre from comment #25)

FYI, My company just auto uninstalled & blocked Firefox and Thunderbird from all corporate assets.
Not honoring the system certificate store was the reason.
This will start to cause a larger decrease in installs & usage as this propagates.
Had to send this from chrome!

Are you using client certificates specifically? Or just trying to read CAs from the system store?

Comment 27

[Markus Schraeder]

By "resolving" bug 1315460 firefox removed automatic import of client certifcates at all, so we removed firefox from our compatibilty list.

Alone of of our customers is about to removed about 20.000 client installations of firefox.

Good work firefox! You resolve you as the problem the right way!

Comment 28

[Markus Schraeder]

-of +one

Comment 31

[Christopher Hill]

If this was enabled, it is possible that Microsoft would be able to get Firefox working for Azure Active Directory Conditional Access bypass, so enterprise users implementing compliance policies or multi-factor authentication bypasses would be able to use FireFox (alongside Chrome, Edge, IE):

https://social.technet.microsoft.com/Forums/en-US/eafe0951-3929-46d1-bcbd-bbe5c006f0e4/firefox-not-compatible-with-conditional-access-why?forum=microsoftintuneprod#ebc8065d-bd5f-466a-aa20-c9014733f29a

Comment 32

[mozilla-firefox]

I have to give up firefox in our large US based company now (55,000 employees) - user certificates are pretty much mandatory for all corporate intranet sites and they work in Chrome, IE and Edge, but not in Firefox. I cannot understand how Firefox should be used in corporate environments, if you do not support the default security requirements in a corporate work space... Really disappointed and sad, I have used Firefox / Mozilla since its first beta release in the 1990s and now will have to use Chrome as default browser in my office...

Comment 33

[Anthony]

The reason for me to use the Windows certificate store for client certificates, is that they can be marked as non-exportable. With Firefox, there's no way to prevent someone from making a backup of the client certificates.

Comment 34

[Lyubomir]

In addition to Anthony, I am on the other side - a user, whose company administratively has marked the user certificate as non-exportable in Windows certstore. As result I cannot use Firefox productively and have to fallback to another pretty uncomfortable browser.

Comment 35

[Tom S. (please needinfo tschuster)]

I think this might work in current Nightly now. Bug 1591269 and dependencies.

Firefox Nightly now supports using client auth certs directly from OS* storage - flip the pref "security.osclientcerts.autoload" to give it a try!

https://twitter.com/mozkeeler/status/1197592164756115456

Comment 36

[mozilla-firefox]

I can get the current nightly working with that setting in our corporate intranet - excellent! Hope this gets rolled out asap.

Comment 37

[Lyubomir]

I tried it also and I was able to see my client certificate from the Windows store in the FF certificates. However, the client cert authentication didn't work, it seems FF didn't send my certificate to the remote server and I always get the logon page.
In addition, I was not able to see the trusted CA certificates from the Windows store. I had to import the relevant ones manually into the FF store in order for the server cert to be accepted.

Comment 38

[Cailin]

@lassenov The server cert issue is another one, and has a solution, see bug 1265113 (tl:dr; set security.enterprise_roots.enabled in about:config to true).

Comment 39

[Lyubomir]

Thanks, Cailin. After enabling enterprise roots I can see the trusted CAs now, but the client cert authn still fails.
How can I find out why it fails?

Comment 40

[Cailin]

No clue, I only happened to know the answer to that one question :D

Comment 41

[Mike Kaply [:mkaply]]

Caitlin: are you using nightly or something else?

Comment 42

[Lyubomir]

I am already able to see the client certs in the Windows store and in most of the cases the client cert authn works. However, there are cases, where it doesn't. How can I check what is wrong or collect traces for further analysis?

Comment 43

[Dana Keeler (she/her) [:keeler]]

(In reply to Lyubomir from comment #42)

I am already able to see the client certs in the Windows store and in most of the cases the client cert authn works. However, there are cases, where it doesn't. How can I check what is wrong or collect traces for further analysis?

You can file a new bug here: https://bugzilla.mozilla.org/enter_bug.cgi?product=Core&component=Security%3A%20PSM
It would be good to include things like what kinds of certificates work vs. don't, or if there are any server differences, and if you can, include a packet trace of the working/not working TLS handshakes.

Comment 44

[Lyubomir]

Here is the new bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1611471

Comment 45

[Dana Keeler (she/her) [:keeler]]

I think we can go ahead and close this.

Comment 46

[Lyubomir]

Unfortunately the luxury period when I was able to work on this issue is over. Although the issue was not resolved I have no other option but to switch to GC. So, you can close this report.

By the way, I observed another issue with client certificates while testing - if a client cert is imported in the Windows certstore and visible in FF, and then deleted from the Windows certstore it is still visible in FF - very strange. Then if again deleted from within FF it disappears from the FF UI, but after reloading the content it appears there again. However, at the same time it is no longer visible via the Windows native UI from IE or GC. Hope this helps to some more extent.

That is all I could do so far. Farewell productive FF. Hello FF for reading news only.