128409 - Certificates and keys are no longer visible with NSS 3.4

Status: RESOLVED INCOMPLETE

(Core Graveyard :: Security: UI, defect, P3)

Description

[Markus Bitterli]

I have a smartcard which works fine with the 0.98 version of Mozilla. On this
smartcard are stored two user certificates with their corresponding keys and two
CA certificates. The two user certs and keys can be used for e-mail signing and
web authentication without any problem.

Since the newest nigthly builds, I assume since NSS 3.4, none of the
certificates is visible and therefore are no longer useable. I have deleted
several times the cert and security db without any effect.

For me it is important that the smartcard will work together with Mozilla.
Therefore I will provide additional information as soon as somebody tells me
what is needed.

With kind regards,
Markus Bitterli

Comment 1

[John Unruh]

Report, is this a dupe of bug 99610? What happens when you try client auth after 
selecting Edit>Prefs>Privacy>Certs>Ask Every Time?

Comment 2

[Markus Bitterli]

The result is the same the certs are not usable, but since every thing worked
fine with the 0.98 version I am not sure wheter it is the same.

Actually I got the following error message when I set it to "Ask every time" and
tried to access a server which requiers client authenticatino with certificastes:

"servername.domain received an incorrect or unexpected message. Error Code: -12227"

 

Comment 3

[John Unruh]

In a newer build, that error would state instead of a number, "SSL peer was 
unable to negotiate an acceptable set of security parameters." Under 
Edit>Prefs>Privacy>SSL, make sure all of the ciphers are available.

Comment 4

[Markus Bitterli]

They are all enabled.

Comment 5

[Stephane Saux]

Is this still happening with daily builds? Have you tried a new profile?

Comment 6

[ptest4]

I experienced the same problem when upgrading from Mozilla 0.9.8 to 0.9.9 
(Build 20020311).  The 3 certificates on the smart card are no longer visible.  
This not only affects web authentication, but it also prevents selecting one of 
the certificates for signing email.  The certificates were visible from Mozilla 
0.9.8 and web authentication and email signing were possible. 

I have tried this with a pre-exsisting profile and with a new one.  With the 
pre-existing profile, even though the signing certificate did not show up, it 
was still possible to sign email because the signing certificate had been 
selected previously in Mozilla 0.9.8.  With the new profile, it was not 
possible to select one of the smart card certificates for web authentication or 
signing.

I am using an ActivCard reader with ActivCard Gold 2.1.0  middleware.  The card 
reader and middleware are functioning correctly and I am able to view the three 
certificates on the card using ActivCard Gold utilities and Netscape 4.79 with 
or without PSM.

Comment 7

[Markus Bitterli]

I've tested it again with Build 2002040314 and a new profile and it is still the
same.

Comment 8

[John Unruh]

Reporter, what if you specifically log in to the hardware device ahead of time? 
Edit>Prefs>Privacy>Certs>Manage Security Devices. Click on your device, then on 
Log In. Can you see and use the certs on the card then?

Comment 9

[Markus Bitterli]

I can't do that, since the smart card tells the software that it has no password
to open it. The reason for that is that it makes no sense that every single
application knows the password to the smartcard. Therefore a smartcard specific
application opens the card and from then on it tells the applicaiton that there
is no password needed.

Comment 10

[John Unruh]

nsbeta1

Comment 11

[Markus Bitterli]

Can somebody tell me what the date of the target milestone 2.2 is?

Comment 12

[John Unruh]

Fixing this depends on bug 135303.

Comment 13

[Stephane Saux]

the fixes are on the tip of NSS. The tip of NSS is not used by either the
mozilla trunk or the 1.0.0 branchy. The plan is to get the tip of NSS to the
trunk of Mozilla by moving the tag, but only when we think NSS is stable enough.
Once that is done we must get the tag merged onto the branch is we want MachV to
have these changes.

Comment 14

[John G. Myers]

Mass reassign ssaux bugs to nobody

Comment 15

[Kai Engert [:KaiE:]]

Do we still have this problem?

Comment 16

[Kai Engert [:KaiE:]]

changing obsolete psm* target to --- (unspecified)