1275180 - Failure to receive S/MIME userCertificate from LDAP server

Status: UNCONFIRMED

(Thunderbird :: Security, defect)

Description

[sef1976]

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2350.0 Iron/44.0.2350.0 Safari/537.36

Steps to reproduce:

I have TD 45.1 linux/windows + OpenLDAP (Centos 6.7)
user have x509 cert in ldap

ldapsearch -h  127.0.0.1 -t -b "dc=msxxx,dc=xx" -x -LLL  "(rfc822mailbox=[e-mail])" "userCertificate;binary"
dn: uid=zimxxxxx,ou=People,dc=msxxx,dc=xx
userCertificate;binary:< file:///tmp/ldapsearch-userCertificate;binary-CdZUpT

but in email TD not find x509 cert on address book on ldap (user info search OK)
if load x509 manual for client not problem in email send with cert.

Comment 1

[sef1976]

test other version TD: on ver 6/12/14 - ldap cert load work
on ver 15+ (...45.b2) not work ....

Comment 2

[:aceman]

It seems to me TB fetches the certificates from LDAP only when the message is attempted to be sent OR if you go into View->Message security info.

Can you tell which of these cases is failing?

Comment 3

[Kai Engert [:KaiE:]]

You claim that Thunderbird fails to download a correspondents S/MIME certificate from a configured LDAP server, even if it's available in the server.

Unfortunately I currently don't have access to an LDAP server that could allow me to test/investigate the current behavior.

Comment 4

[:aceman]

This could have already been fixed, see bug 1509586 comment 6.
Needs retesting with TB 60 or 68.

Comment 5

[Lukas.Wringer]

Hi, just tried it with two different Public ldap Servers of two PKIs. I tried it on 68.12.1 (Windows) and on 78.6.1 (Linux/Debian) and couldn't get it to fetch the S/MIME Certificate / public key. I tried looking into the Security Info and I tried sending after enabling encryption - I always get an Error that no key/cert was found. An ldapsearch shows the Certificate, one presents as "userCertificate;binary::" and the other ldap just as "userCertificate::".

For both providers exist somewhat dated instructions on how to configure Thunderbird so at least it has been working in the past...

There are enough public providers like the openkeys or the DFN-PKI ldap you could test it out with...

Comment 6

[slamb]

Does TB parse userSMIMECertificate;binary (pkcs7/cms)? I see TB process userCertificate;binary but not userSMIMECertificate;binary. This is a problem for most s/mime certs as they require intermediates to validate. I will try multi-valued userCertificate;binary response (with intermediate cert in addition to end cert) to see TB picks that up. Fwiw Outlook (Mac) parses userSMIMECertificate;binary (der) properly.